5

I'm configuring a pretty standard webserver using nginx. The server is working as expected, however, there is a small configuration detail I would like to understand.

My current configuration is:

index index.html index.htm index.php;

location / {
    try_files $uri $uri/ /index.php?q=$uri;
}

location ~ \.php$ {
    try_files $uri =404;
    fastcgi_index index.php;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include /etc/nginx/fastcgi_params;
}

With this configuration, if I access to: http://myweb.com/wp-content/uploads/2012/10/cropped-bitmap11.png/lol.php I get a 404 as expected.

However, with this configuration:

try_files $uri =404;

location ~ \.php$ {
    fastcgi_index index.php;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include /etc/nginx/fastcgi_params;
}

I get a blank page with "Access denied".

Why is the result different?

Thank you

2 Answers 2

17

You are probably under the impression that try_files on server level must work for every request. Not at all. Quite the contrary, it works only for requests that match no location blocks.

3

short anwser: as of php5.3.9, php-fpm does not allow extensions other than .php and .php5 because of the default value for security.limit_extensions and your request as been made to an existent .png file.

long answer: this is nothing to do with try_files being inside or outside of a location block. let's break and explain:

request is: http://myweb.com/wp-content/uploads/2012/10/cropped-bitmap11.png/lol.php

on your first configuration

  • it matches the location ~ .php$ { ... } block because the request ends with .php.
  • the try_files $uri =404; directive inside .php$ location causes nginx return 404 as there is no file named $uri (=/wp-content/uploads/2012/10/cropped-bitmap11.png/lol.php)
  • the location / { ... } block never matches. it is only matched if no other location blocks are matched. (see http://wiki.nginx.org/HttpCoreModule#location)

on your second configuration

  • again, as the request ends with .php, it matches the .php$ location block.
  • there is no check for a file existence inside the location block, the request is directly passed to the fastcgi process.
  • fastcgi process finds the /wp-content/uploads/2012/10/cropped-bitmap11.png (appearently, it exists) and denies to run the request, because of the .png extension. (see the short answer)

i don't know if it is a bug or a "by design" thing but, contrary to "root" directive, a try_files directive outside the location blocks does not inherited inside the location block. (somebody may correct this if it is wrong)

1
  • 3
    a try_files directive outside the location blocks does not inherited inside the location block I think this is the key point. If this is right, all makes sense Feb 22, 2013 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.