[CentOS] php config security concern for c5

a recent post on bugtraq hilighted an issue with how upstream has configured apache to invoke php, namely using addhandler, which has the behavior of matching the extension anywhere in the file. this means that foo.php.jpg will be run as php. where this becomes an issue is web apps that allow uploads into the webspace for images, pdfs, etc. if the app assumes that anything.jpg is safe, this addhandler feature will surprise it.

a fix is to replace two lines in /etc/httpd/conf.d/php.conf:

AddHandler php5-script .php AddType text/html .php

with:

<FilesMatch .php$> SetHandler php5-script ForceType text/html </FilesMatch>

i have reported this upstream. hopefully they will see it as a problem and address it.