Skip to content

Use regular expressions for files to hide and upload extensions #23

Description

@afritsch

I am no pro with regexes but this is what I came up with for starters:
For files to hide: [iI][nN][dD][eE][xX]\.([hH][tT][mM][lL]?|[pP][hH][pP])|\..*
This should catch ANY hidden files/folders and files named index.php or index.htm(l). This should also be easily expandable to catch other potentially malicious extensions/scripts (perl, sh, ruby etc).

I would suggest to also use regexes for upload_reject_extension and hidden_dirs and maybe others I didn't consider.

Tested on http://rubular.com/ with teststring

.test/
.htpasswd
.htaccess
index.html
index.php
index.htm

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions