From 227fcdcaef09758870b63665bf6afff1b1ee433f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Josu=C3=A9=20Tille?= <josue@tille.ch>
Date: Tue, 14 May 2019 17:14:24 +0200
Subject: [PATCH] [Security] Improve php path in nginx config

---
 conf/nginx.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/nginx.conf b/conf/nginx.conf
index 2b0aaa3..6209c39 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -10,8 +10,8 @@ location __PATH__/ {
     # Common parameter to increase upload size limit in conjuction with dedicated php-fpm file
     client_max_body_size 100M;
 
-    #try_files $uri $uri/ index.php;
-    location ~ [^/]\.php(/|$) {
+    # Use the specific path for the php file. It's more secure than global php path
+    location __PATH__/get_user_token.php {
         fastcgi_split_path_info ^(.+?\.php)(/.*)$;
         fastcgi_pass unix:/var/run/php5-fpm-__NAME__.sock;
         fastcgi_index index.php;