[SECURITY] Disallow pht as file extension (0100f1e8) · Commits · TYPO3 / TYPO3.CMS

Commit 0100f1e8 authored 7 years ago by

Susanne Moog Committed by Oliver Hader 7 years ago

[SECURITY] Disallow pht as file extension

Some web servers allow and accept pht files as PHP files
and execute them. Thus, pht should be part of the default
file deny pattern and PHP file extensions.

Resolves: #82078
Releases: master, 8.7, 7.6
Security-Commit: d7e19499bfa4bd552d4428a2b9a943005c20c61d
Security-Bulletin: TYPO3-CORE-SA-2017-007
Change-Id: Ibadcaa8c32b70b9aec569027862918d0360ec075
Reviewed-on: https://review.typo3.org/53904


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>

parent c6498b2d

Branches