Search code examples
securityfastcgifile-extensioncase-insensitive

Make PHP-FPM security.limit_extensions case insensitive


Make PHP-FPM security.limit_extensions case insensitive;

I have set the option to the following:

security.limit_extensions = .php .php3 .php4 .php5 .php7 .html .phtml .phps .js

Why am I using .js in it? Because I have dynamic JS content which changes a little bit of stuff sometimes...

But it throws out a 403 Forbidden message when I change the file extension to .HTML, or .JS for example.

It only works for lower case.


Solution

  • The dumbest way is to simply write out all possible case variants in the setting. The following bash command

    echo security.limit_extensions = .{P,p}{H,h}{P,p}{,3,4,5,7,S,s} .{P,p,}{H,h}{T,t}{M,m}{L,l} .{J,j}{S,s}
    

    will generate them all, namely:

    security.limit_extensions = .PHP .PHP3 .PHP4 .PHP5 .PHP7 .PHPS .PHPs .PHp .PHp3 .PHp4 .PHp5 .PHp7 .PHpS .PHps .PhP .PhP3 .PhP4 .PhP5 .PhP7 .PhPS .PhPs .Php .Php3 .Php4 .Php5 .Php7 .PhpS .Phps .pHP .pHP3 .pHP4 .pHP5 .pHP7 .pHPS .pHPs .pHp .pHp3 .pHp4 .pHp5 .pHp7 .pHpS .pHps .phP .phP3 .phP4 .phP5 .phP7 .phPS .phPs .php .php3 .php4 .php5 .php7 .phpS .phps .PHTML .PHTMl .PHTmL .PHTml .PHtML .PHtMl .PHtmL .PHtml .PhTML .PhTMl .PhTmL .PhTml .PhtML .PhtMl .PhtmL .Phtml .pHTML .pHTMl .pHTmL .pHTml .pHtML .pHtMl .pHtmL .pHtml .phTML .phTMl .phTmL .phTml .phtML .phtMl .phtmL .phtml .HTML .HTMl .HTmL .HTml .HtML .HtMl .HtmL .Html .hTML .hTMl .hTmL .hTml .htML .htMl .htmL .html .JS .Js .jS .js
    

    I would, however, instead suggest just changing your extensions to be lowercase. You can use an utility such as rename to do just that:

    shopt -s globstar
    rename 's!(\.\w+)+$!lc $&!e' **/*.*