rule to remove "Public files directory Not fully protected" in nginx?

Question

I use D7 with nginx and php5-fpm on Linux and get this security warning:

Public files directory Not fully protected

I see here that one needs to use this snippet in Apache's htaccess to resolve the issue:

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</files>

Just wondering what should be the nginx equivalent rule?

Update: I already have this in my nginx configs:

root   /path/to/drupal;
}

location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
                return 404;
        }
        try_files $uri =404;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include fastcgi_params;
}

Answer 1

The .htaccess file won't have any effect in Nginx. You'll need to add your own rules to prevent PHP execution in the files directory.

e.g:

# Allow access to index.php only
location = /index.php {
  include fastcgi.conf;
  fastcgi_pass    127.0.0.1:9000;
}

# Any other attempt to access PHP files returns a 403.
location ~ \.php$ {
  return 403;
}

However, to fix that error message, you can actually just delete the old .htaccess file and Drupal will recreate a new correct one.

Note: the check is in system_requirements with the line

if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) { 

It only checks for that line, Drupal doesn't currently validate an actual PHP request to the relevant directory to test the handler.