Block PHP execution outside index.php in the lighttpd and IIS samples

[LukeTowers]

The Apache configuration Winter ships carries an explicit rule:

##
## Block all PHP files, except index
##
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} \.php$
RewriteRule !^index.php index.php [L,NC]

and the nginx sample achieves the same thing structurally, since location ~ ^/index.php is the only location that reaches FastCGI.

The lighttpd and IIS samples had no equivalent. Both deliberately serve the public storage paths and the asset paths as-is — that is the point of those rules — but as a result a PHP file written anywhere underneath them is handed to the PHP handler rather than being routed to the front controller. The other two configurations do not behave that way, so this brings all four in line.

Changes

• lighttpd — adds a .php rule as the first entry in url.rewrite-once. Ordering matters: url.rewrite-once is first-match-wins, and the passthrough rules below it return their paths unchanged, so the restriction has to be evaluated before them.
• IIS — adds a Block all PHP files, except index rule ahead of the existing catch-all, with stopProcessing="true", matching \.php$ and negating index.php.
• nginx — no behavioural change, just a note on the PHP location recording that it matches /index.php alone on purpose, so it does not get broadened to location ~ \.php$ later.

Testing

Both rules are written against the documented behaviour of each server (lighttpd's PCRE url.rewrite-once and the IIS URL Rewrite module) and reviewed against the existing rules they sit beside, but I have not run them against live lighttpd or IIS servers — I do not have either to hand. A review from someone who deploys on those would be welcome, particularly on the lighttpd negative-lookahead syntax.

Defence in depth rather than a fix for a known exploit path: nothing in Winter writes PHP into those directories.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e3f2c60f-630b-4396-b7ef-8f5f9cb4959f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}