Mediawiki arbitrary script excecution prevention

[fn7]

I am trying to install mediawiki without using softaculous but I haven't worked out how to do a similar thing to editing the httpd.conf file with cpanel and would like to know how, if possible you can do it.

 

[descalzo]

You cannot edit the httpd.conf file here, but you sometimes can do things via .htaccess etc.

Exactly what do you want to do?

 

[fn7]

Mediawiki wants to prevent execution of php files in the uploads directory, here is what you are supposed to do normally: http://www.mediawiki.org/wiki/Manual:Security#Upload_security

 

[descalzo]

Well, just create a .htaccess file in the directory in question and add:

AllowOverride None
 
   # Serve HTML as plaintext, don't execute SHTML
AddType text/plain .html .htm .shtml .php
 
   # Don't run arbitrary PHP code.
php_admin_flag engine off

and that (at least on Chopin) turns off execution of .php files and serves them up as plain text.

Be aware of other pitfalls of allowing uploads. ie, you are 100% responsible for the content on your site. Copyright infringement, adult material, etc. Also, the files must be part of the site, not just uploaded as an online archive.

 

[fn7]

Thank you for that, I will either make the wiki admin edit only or constantly moderate user posts however I didn't beleve that apache would fully allow .htaccess functions like that though seeing that it does thanks :biggrin:!