Denying access to pico's internal files

[picocms]

Denying access to pico's internal files

[PhrozenByte]

Letting Pico handle requests to Pico's internal files like config is neither more nor less secure than passing it to nginx; the only difference is that the latter exposes the existence of these directories, because they are treated differently than any other non-existing files/dirs.

Not sure why you were experiencing this issue; did you try removing the error_page directive? Configuring nginx is a very extensive subject and you often get unexpected results.

[ohnonot]

did you try removing the error_page directive?

yes, i did.
Set up as above, it will give me generic 404 messages.
If however I use try_files /index.php$is_args$args =404; (as in the config example) instead of return 404;, i'm back at the strange behavior of being offered index.php to download.
I have been shifting around the location blocks and trying things for another hour or so, I can't get to the bottom of it.

The way it is now works well for me; I'd just like to understand why it doesn't work as per documentation. Does it work for you?

[PhrozenByte]

Unfortunatly I'm not using nginx and don't have much experience with it, the nginx docs were written by @smcdougall. However, at the time of writing, it worked as expected. No idea what's wrong there 😒

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in two days if no further activity occurs. Thank you for your contributions! 👍