edb4c397df
Upstream: https://github.com/YunoHost/yunohost @ 3a5f8bac8301c450897b96cbd43a4c7d3ba750fb But (José) : transformer tout le code en bions + ploxions du xerboxion. La carte de digestion vit au labo : /yunohost-digest.json
54 lines
2.3 KiB
Plaintext
54 lines
2.3 KiB
Plaintext
fastcgi_index index.php;
|
|
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
|
|
|
fastcgi_param QUERY_STRING $query_string;
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
|
|
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
|
fastcgi_param SCRIPT_FILENAME $request_filename;
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
fastcgi_param REQUEST_SCHEME $scheme;
|
|
fastcgi_param HTTPS $https if_not_empty;
|
|
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
|
fastcgi_param REMOTE_USER $http_ynh_user if_not_empty;
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
|
fastcgi_param SERVER_PORT $server_port;
|
|
fastcgi_param SERVER_NAME $server_name;
|
|
|
|
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
|
fastcgi_param REDIRECT_STATUS 200;
|
|
|
|
# Hotfix CVE-2026-42945
|
|
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
|
|
# Host value ("malformedhost") to the backend application, even though it does
|
|
# not match the effective request target. Applications often use HTTP_HOST for
|
|
# redirects, absolute URL generation, virtual host routing, or security checks;
|
|
# forwarding the raw Host header can therefore lead to incorrect or unsafe
|
|
# behaviour.
|
|
#
|
|
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
|
|
# "$request_port", allowing HTTP_HOST to be constructed as:
|
|
# $host$is_request_port$request_port
|
|
#
|
|
# In stable/oldstable packages we use "$host" as a security workaround.
|
|
# It avoids forwarding an untrusted raw Host header to the backend.
|
|
#
|
|
# Note: this changes behaviour compared to previous versions, because "$host"
|
|
# does not preserve the client-supplied port, while "$http_host" typically
|
|
# does. Existing deployments that rely on "$http_host" containing a port number
|
|
# may therefore break or behave differently after this change.
|
|
|
|
fastcgi_param HTTP_HOST $host;
|