71–80 of 94 posts
http://ycorpblog.com/wp-config-sample.php
http://blogs.wsj.com/law/wp-config-sample.php
http://blog.us.playstation.com/wp-config-sample.php
...
To protect the wp-config.php file using htaccess is a well known security precaution for any WP pro. The issue however is if you have a copy of said file, in which case protecting the main version would be useless. Also I'd say the blame if you can assign any is on Vim, Emacs, Gedit, and Nano which would have had to crash in order to set these chain of events in motion.
I bet you 1% of every web site or server in existence does something so blatantly and unthinkably wrong that it would make any sysadmins eyes pop out of his head.
1% is in fact extremely low in my opinion—my guess would be closer to 10-15% of sites have some glaring security hole.
The only important thing is to not let it be your site.
Lol. That's just called statistics. I bet you 1% of every web site or server in existence does something so blatantly and unthinkably wrong that it would make any sysadmins eyes pop out of his head. 1% is in fact extremely low in my opinion—my guess would be closer to 10-15% of sites have some glaring security hole. The only important thing is to not let it be your site.
Earlier quoted context omitted.
Yes you can. Dotdeb's php-fpm.ini even includes this line by default: ; To configure the pools it is recommended to have one .conf file per ; pool in the following directory: include=/etc/php5/fpm/pool.d/*.conf Then you could configure ENV inside FPM pool using the env directive: env[DB_HOST] = localhost env[DB_USER] = foobar env[DB_PASSWORD] = foobar ...and use something like this in e.g. Wordpress config: define('D…
That's pretty handy. Didn't think about the phpinfo thing, actually, though in all fairness if they managed to upload any PHP files you're rather screwed. I think the way to be secure would be to not actually serve PHP files in the document root and instead have nginx proxy / directly to the FPM pool, and just alias your static files over, much as one would with Django.
RewriteCond %{REQUEST_URI} ^somefolder.*
RewriteRule ^(.*)$ /index.php?/$1 [L]The title of the linked post is 1% of CMS-Powered Sites Expose Their Database Passwords - has it changed since submission?
0. Put local config files outside of webroot or other publicly accessible directories, include programatically. 1. Disable swap/backup files in your editor (or write them to a different location)[1] 2. Git ignore or SVN ignore swap files and backup files 3. Configure your web server to not serve such files. Some combination of these should keep you safe. :) [1]: in vim: noswap nobackup nowritebackup or http://vim.wik…
Earlier quoted context omitted.
That's not restricted to PHP, since it does not even depend on the language.
True, but other languages are not typically processed in the traditional mod_php way where urls are directly mapped to files in your static root, thus it's extremely rare to see e.g. python or ruby files served as static files.
Do software like XAMP have bad defaults and shouldn't be used for production out of the box? Maybe.
Has that helped a lot of people to get started, and make PHP the most popular server language for the web? Definitely.
Should we mock all php devs including experts, because of designers or ninja CEOs who tried/succeeded in editiing or making a website but made some mistakes in the process? The answer is still no.
> Latest stats say that about 13.8% of the top 10,000 websites run CMSs. If we just focus on CMS-powered websites, then the percentage of vulnerable sites is much higher:
> Thus, 230 / (216391 * 0.138) = 0.77% of websites running a CMS are vulnerable.
I don't think those numbers mean what you think they mean.
13.8% out of 10,000 doesn't say much about the top 216,391. And perhaps 0 out of 230 of the vulnerable websites use CMS, however unlikely that is.