服务器禁用PHP执行权限的目录配置方法

# ✅ 推荐：在上传目录中禁止所有PHP执行
location /uploads/ {
    alias /var/www/html/uploads/;

    # 禁止该目录下所有.php文件的访问
    location ~ \.php$ {
        deny all;
        return 403;
    }
}

# ⚠️ 可用但有风险
location /uploads/ {
    root /var/www/html;
    # 没有 fastcgi_pass，PHP文件会被下载而非执行
}

# ❌ 不推荐：if在location中属于"evil"用法
location /uploads/ {
    if ($request_filename ~* \.php$) {
        return 403;
    }
}

server {
    root /var/www/html;

    # 默认禁止所有PHP执行
    location ~ \.php$ {
        deny all;
    }

    # 仅允许特定目录执行PHP
    location ~ ^/(app|admin|api)/.*\.php$ {
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    }
}

# ✅ Apache 2.4+ 推荐写法
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

# ✅ 兼容旧版本的写法
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# ✅ 在httpd.conf或虚拟主机配置中
<Directory "/var/www/html/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# 在特定目录中取消PHP处理器关联
<Directory "/var/www/html/cache">
    RemoveHandler .php .phtml .php3 .php4 .php5
    RemoveType .php .phtml .php3 .php4 .php5
</Directory>

# 1. 检查Nginx配置语法
nginx -t

# 2. 重载配置
systemctl reload nginx

# 3. 创建测试PHP文件并验证
echo '<?php phpinfo(); ?>' > /var/www/html/uploads/test.php
curl -I http://localhost/uploads/test.php
# 预期返回：HTTP/1.1 403 Forbidden

# 4. 确认正常PHP目录不受影响
curl -I http://localhost/index.php
# 预期返回：HTTP/1.1 200 OK