The magento team detail a remote code execution bug here: http://www.magentocommerce.com/knowledge-base/entry/security-add-handler
The test is to create a file eg test.php.csv and see if it can be executed by browsing to it. Here is the content quoted on the site
When I browse to this file, it does nothing. However, to me it does not appear to be correct PHP, and if I change the code to the following:
<?php phpinfo(); ?>
then the file CAN be executed. So firstly, is article wrong, or was I wrong to "correct" the test?
Secondly, the following directive is simply not present in my config
AddHandler application/x-httpd-php .php
And adding the other bits of code quoted in that article seems to make no difference at all.
I feel I'm missing the jist of something here. Additionally, magento is full of files that contain php but don't have a php extension (eg .phtml) so I feel the suggested change would break that - although I could specify .phtml files to be executed by the same handler - not too sure how that sits with URL rewrites though.
I'm using Centos 6. We use PHP from the remi repsitory as per the magento setup guide