<div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">I did some testing, but I did it so kickly that in the end I have sent my report e-mails to Oliver - sorry Oliver - in error as it was supposed to be sent to the list, well here is a summary of all the e-mails.</span></div>
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br>
</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">----</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br>
</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">!1st e-mail</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br>
</span></div>I care a lot, but I know very little about it and I am just waiting to see to what conclusion you both are going to get.</span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Even though I know very little, I will try it myself and report.</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">----</div><div><br></div>!2nd e-mail<div><br></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Tested in </span>1dollar-webhosting<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"> servers where my site is hosted </span><span style="background-color:rgb(255,255,255);color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">(shame)</span><span style="background-color:rgb(255,255,255);color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">, what I get while trying to upload the file called forrest.php, which has the following code inside.</span></div>
<div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
-----8x-----</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><?php </div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
echo "<p>Run Forrest! Run!</p>"</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">-----8x-----</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">While trying to upload the file I got redirected to the url bellow:</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><a href="http://codex.wiki.br/cgi-sys/amplugin.shtml" target="_blank" style="color:rgb(17,85,204)">http://codex.wiki.br/cgi-sys/amplugin.shtml</a></div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
That has the following message :</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
"</div><h1 style="color:rgb(34,34,34);background-color:rgb(255,255,255);font-family:'Times New Roman'">Alerta de segurança</h1><p style="color:rgb(34,34,34);background-color:rgb(255,255,255);font-family:'Times New Roman';font-size:medium">
O arquivo que você está tentando fazer upload foi rejeitado pelo servidor.<br>Provavelmente, o arquivo contém vÃrus ou trojans que podem danificar seu website.</p><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<span style="font-family:'Times New Roman';font-size:medium">Não tente carregá-lo novamente como seu endereço de IP pode ser bloqueada.</span>"</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">The message might be shown in other languages I guess, the encoding is wrong here in this e-mail and where the message is located. ( I believe it also depends on your e-mail reader, browser and encoding detection)</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
Briefly the message says that the file was rejected for upload and if I insist in uploading, my ip could be banned.</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">I could not upload the file even with different extensions, including ".txt" and also trying to make the code hard to detect.</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
This behavior is not good for me as I write code there and I wish I could upload the code as php files, but this is just my situation.</div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">----</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">!3rd e-mail</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="background-color:rgb(255,255,255)"><font color="#222222" face="arial, sans-serif">I have discovered one thing, when using this in .htaccess, and I hope I am doing it right:</font><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">-----8x-----</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><div>Options -ExecCGI</div><div>SetHandler default-handler</div>
</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">-----8x-----</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">
I just recieve an 404 message when trying to get to "/uploads/".</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">
While just using:</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><div>-----8x-----</div><div><div>Options -ExecCGI</div>
<div>-----8x-----</div></div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><br></div><div><font color="#222222" face="arial, sans-serif">I can read the folder and access the other folders inside it, even though the folders inside "/uploads/" appear as if they were displayed in the wrong encoding as well, as some of the words forming folder names use diacritics.</font></div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">This is my report.</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">CarlosAB</div></div><div><br><div class="gmail_quote">2013/3/13 Petko Yotov <span dir="ltr"><<a href="mailto:5ko@5ko.fr" target="_blank">5ko@5ko.fr</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'd like to read some opinions from different people about this question - if you can do some tests on your own servers, please find out what .htaccess settings disallow script execution for the uploaded files on your wiki, and report here.<br>
<br>
Thanks!<br>
Petko<br>
<br>
Oliver Betz writes:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
In addition, I suggest to completely disallow execution of scripts in<br>
upload directories.<br>
<br>
For Apache .htaccess I found:<br>
<br>
"Options -ExecCGI" - that's very effective in usual virtual hosting<br>
environments but doesn't help for languages running as module.<br>
<br>
"SetHandler default-handler" works also for script languages running<br>
as module.<br>
<br>
Before I add this information to the PmWiki documentation, I would<br>
appreciate comments from people with better Apache knowledge.<br>
</blockquote>
</blockquote></div><div><br></div>----<br>Codex<br><a href="http://codex.wiki.br/">http://codex.wiki.br/</a>
</div>