Apache AddHandler moved to AddType due to security considerations

Posté le dimanche 29 mars 2009

Hi,

Due to security considerations, AddHandler should not be used in apache configuration files. As uncovered by an old thread on the suphp mailing list, this would allow any files containing ".php" to be executed by php (for example example.php.jpg, trust me, this is not what you want ;) ).

As using AddHandler was sadly advised in our FAQ example, most of our hosted people were using it in their .htaccess. To fix this security flaw, we have added full support to AddType, modified our FAQ and run a script to widely and roughly modify all .htaccess files to retroactively fix the problem on TuxFamily.

If you were using a custom .htaccess file containing AddHander/AddType instructions, please check that everything is still working fine as our script may have introduced some side effects.

If you are automatically upgrading your website through rsync or such, please fix your local copy of .htaccess according to the new version of the FAQ.

However, we are not the only one to blame, because the Apache documentation is very unclear on this particular point, as you can see on the addhandler and addtype descriptions.

Your admins