In Apache, when not configured, for PHP script, Acceptpathinfo is accepted by default, that is to say:
If there is a/laruence/index.php in the server
So, for the following request,
Copy Code code as follows:
/laruence/index.php/dummy
/laruence/dumm
Apache is accepted, will be considered to be access to info.php, and will set Path_info to dummy
For Nginx, the path INFO is not supported, which means that it does not default to Path_info.
And because the default profile for PHP support is only very basic, so for the default configuration for the above access will also be 404, prompted the error can not find the file.
This is simply fatal for some PHP frameworks that use PATH_INFO to deliver critical information (such as Kohana, thinkphp).
For this problem, there are generally two solutions, the first is to use rewrite, but the disadvantage of this method is also obvious, you need to convert Path_info to query String. This is not the way to say it.
And the second method is what I'm going to mention today, the mock path_info:
First of all, we know that in nginx, we are going to give the PHP CGI server an explanation by matching the filename extension. Typically, the following default configuration segments are available in nginx.conf:
Copy Code code as follows:
Location ~. php$ {
Fastcgi_index index.php;
Fastcgi_pass 127.0.0.1:9000;
Include Fastcgi_params;
Therefore, for a file path such as/laruence/info.php/pathinfo, Nginx is not properly handed to the PHP CGI server. So we need to rewrite this configuration to:
Copy Code code as follows:
Location ~. php {//Fragment match
Fastcgi_index index.php;
Fastcgi_pass 127.0.0.1:9000;
Include Fastcgi_params;
Now the script path has been left to PHP to handle. How do you increase the path_info?
First, we need to open the Cgi.fix_pathinfo configuration entry in PHP, open this configuration item, PHP will go to the CGI specification to check the Script_filename in that part of the Access script and path_info (INI configuration explanation), And according to Script_name to modify Path_info (and path_translated) for the correct value (in fact, that is to say, PHP initial support for CGI 1.1 is not in place)
Then, just add a Fastcgi_param item:
Copy Code code as follows:
Location ~. php {
Fastcgi_index index.php;
Fastcgi_pass 127.0.0.1:9000;
Include Fastcgi_params;
Fastcgi_param path_info $fastcgi _script_name;
Try it now ...
BTW: Of course, the above solution to the path analysis to the PHP to deal with, Online also has a friend to give a different configuration method, this method is by Nginx to analyze the path (also do not need Fix_pathinfo):
Copy Code code as follows:
Location ~ \.php
{
Fastcgi_index index.php;
Fastcgi_pass 127.0.0.1:9000;
Include Fastcgi_params;
Set $path _info "";
Set $real _script_name $fastcgi _script_name;
if ($fastcgi _script_name ~ "^ (. +?\.php) (/.+) $") {
Set $real _script_name $;
Set $path _info $;
}
Fastcgi_param script_filename/var/html/$real _script_name;
Fastcgi_param script_name $real _script_name;
Fastcgi_param path_info $path _info;
PostScript, a recent discovery of a security vulnerability (Nginx + PHP cgi a possible security vulnerability) and this configuration is related, please be sure to use the second configuration, the time to turn off the cgi.fix_pathinfo. In addition to this loophole I personally think this has nothing to do with Nginx, does not belong to the nginx loophole. Is the problem of configuration, now everywhere is said to be nginx bug, improper.
