The magento team detail a remote code execution bug here: http://www.magentocommerce.com/knowledge-base/entry/security-add-handler

The test is to create a file eg test.php.csv and see if it can be executed by browsing to it. Here is the content quoted on the site


When I browse to this file, it does nothing. However, to me it does not appear to be correct PHP, and if I change the code to the following:


then the file CAN be executed. So firstly, is article wrong, or was I wrong to "correct" the test?

Secondly, the following directive is simply not present in my config

AddHandler application/x-httpd-php .php

And adding the other bits of code quoted in that article seems to make no difference at all.

I feel I'm missing the jist of something here. Additionally, magento is full of files that contain php but don't have a php extension (eg .phtml) so I feel the suggested change would break that - although I could specify .phtml files to be executed by the same handler - not too sure how that sits with URL rewrites though.

I'm using Centos 6. We use PHP from the remi repsitory as per the magento setup guide

1 Answer 1

  1. You are right, the code lacks a semicolon to be valid PHP (however, the closing tag ?> is not necessary at the end of a file
  2. Search for AddHandler and SetHandler in all configuration files (for example using grep -r Handler /etc/apache2) and also in your .htaccess files, you might have missed it
  3. phtml files should not be executable on their own anyway, so it's fine. This handler configuration only applied for direct requests, not for include in PHP. Side note: No configuration will stop you from doing include 'php.csv'; (which would execute PHP code in php.csv)
  • Thanks. In the case of CentOS the place to search is /etc/httpd. I found the offending lines in php.conf, changed as per the article I originally sited and now it's fixed. On a newer installation from the same repositories, the config was correct already.
    – Rodney
    Commented Mar 11, 2015 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.