# Can't figure out secure PHP incantation for owncloud

**URL:** <https://www.ruby-forum.com/t/cant-figure-out-secure-php-incantation-for-owncloud/229489>\
**Category:** NGINX\
**Created:** [January 2, 2013, 12:19pm UTC](https://www.ruby-forum.com/t/cant-figure-out-secure-php-incantation-for-owncloud/229489 "2013-01-02T12:19:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ewildgoose](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/bcef8e/32.png) [@ewildgoose](https://www.ruby-forum.com/u/ewildgoose)\
**Post date:** [January 2, 2013, 12:19pm UTC](https://www.ruby-forum.com/t/cant-figure-out-secure-php-incantation-for-owncloud/229489/1 "2013-01-02T12:19:13Z")

</div>

Hi, I’m using php-fpm to run an “owncloud” install. The application in  
question is a bit icky in that it has PHP files spread across the  
filesystem, uploadable data files in the htdocs root, all PHP files  
default to writeable (erk) and there is extensive use of both path\_info  
and parameters. I’m struggling to figure out a a secure implementation  
for the php execution which guarantees that the PHP files in question  
exist and aren’t in the upload directory.

So example (expected) php URLs would be:

# with path\_info and params

(index|remote|public|status).php/some/long/path?possibly=withparams  
(public|remote|index).php?some=params

# scattered around the filesystem in various (limited) subdirs

(apps|search|core)/._/._.php?some=params

# needing default index file (grr)

/?app=gallery&getfile=ajax%2Fthumbnail.php&filepath=blah

# to return asset files (eek?)

/remote.php?core.css  
/remote.php/core.css

I’m struggling to figure out how to use try\_files to ensure that the php  
file in question really exists, because it seems like using try\_files  
changes the URI and removes the path\_info part?

(Also note that some asset files are returned by php scripts and we  
desire to match those urls and set various expiry/cache times on them.)

At present I have:

fastcgi2.conf is a copy of fastcgi.conf with one change:  
fastcgi\_param REQUEST\_URI $uri$is\_args$args;

nginx config:

```
     server {
             listen 443;
             server_name cloud.example.com;

             ssl on;
             ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
             ssl_certificate_key 

```

/etc/ssl/nginx/cloud.example.com.key;

```
             access_log /var/log/nginx/cloud.example.com.access_log

```

main;  
error\_log /var/log/nginx/cloud.example.com.error\_log  
info;

```
             root /var/www/$server_name/htdocs;

             client_max_body_size 1200M;
             fastcgi_buffers 64 4K;

             index index.php;

             location ~ 

```

^/(data|config|.ht|db\_structure.xml|README) {  
deny all;  
}

```
             location / {
                     rewrite ^/.well-known/host-meta

```

/public.php?service=host-meta last;  
rewrite ^/.well-known/carddav  
/remote.php/carddav/ redirect;  
rewrite ^/.well-known/caldav  
/remote.php/caldav/ redirect;

```
                     try_files $uri $uri/ index.php;
             }

             location ~ ^(?P<script_name>.+\.php)(/|$) {
                     fastcgi_split_path_info ^(.+\.php)(/.*)$;
                     if (!-f $script_name) {
                             #return 404;
                             break;
                     }
                     include fastcgi2.conf;
                     fastcgi_pass 127.0.0.1:9000;
             }

             location ~* ^.+.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ 

```

{  
expires 30d;  
access\_log off;  
}

```
     }

```

Can anyone please help me do better with the php section? In particular  
for some reason if I use “return 404” then the app breaks, seems like  
the URL paths get messed up (why?), however, leaving it as is, then  
missing files return a 403 response…

Thanks for any help (I guess it can go on the wiki once thrashed out?)

Ed W