One entryMerged PR· StuMason/shop-template· PHP
PR #10 merged: security: deny PHP execution under /storage and /uploads
additions
+7
deletions
-0
files changed
1
Returns 403 for any *.php under /storage//uploads, before the generic location ~ .php$ handler. Closes the Laravel web-shell vector (storage:link symlinks a writable dir into public/). Mirrors the stuartmason.co.uk incident + laravel-coolify#109.