URL to Drupal.org article Preventing execution of untrusted PHP
<IfModule mod_php5.c> php_flag engine off </IfModule>
mod_php7.c version doesn't fix.
Temporary solutions are:
ProxyPassMatch ^/(.*\.php(/.*)?)$ "fcgi://127.0.0.1:9000/var/www/drupal"
<FilesMatch \.php$> SetHandler "proxy:fcgi://127.0.0.1:9000" </FilesMatch>
But they are not recommended and they are overrideable.
There is a Drupal Core issue for adding
.htaccess, but it's only for Drupal 8 (so how is this solved in Drupal 7 then?) https://www.drupal.org/node/2455465
There is solution for Apache How to disable PHP files from being run in the sites/default/files directory? but not
So what is the solution?
(I'm running Security Review module that reports PHPs are executable within sites/defaul/files)
www-data:www-data 755 for dirs / 644 for files
# Turn off all options we don't need. Options None Options +FollowSymLinks # Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 <Files *> # Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003 </Files> # If we know how to do it safely, disable the PHP engine entirely. <IfModule mod_php5.c> php_flag engine off </IfModule> <IfModule mod_php7.c> php_flag engine off </IfModule>
I did restart nginx and php7.0-fpm.