RSS Feed/News nginx-related manual security fault

[ENXF NET]

In XenForo 2.x manual, where nginx webserver configuration described, there's a potential security fault related to php scripts:

Friendly URLs | Manual | XenForo ​

End-user documentation for XenForo

xenforo.com
With this setup, every visitor still can execute any php scripts behind protected folders, like src, internal_data, etc
All protected routes need to have ^~ at the beginning of path, so the final version should look like this:
NGINX:

location ^~ /xf/install/data/ {
    internal;
}

location ^~...

Read more

Continue reading...