{% extends "default.conf.j2" %}
{#
#
#    ---- nginx server template for PHP5 websites ----
#
# This template is deprecated.
# Refer to the documentation in /docs/defaults-detailed.rst for alternatives.
#
# List of parameters supported by this template:
#
#   - item.php5: ''
#       Name of nginx upstream to use.
#
#       If undefined, '.php' files will be protected by =403.
#
#
#   - item.index: ''
#       String of index files to enable.
#
#       If undefined, add 'index.php' at the end of list of index files.
#
#
#   - item.php5_limit_except: '' or False
#       String of methods to allow for all hosts.
#
#       If undefined, default limits will be applied (block all requests execpt
#       GET, HEAD and POST).
#
#       If set to False, limits are disabled.
#
#       More information:
#       https://nginx.org/en/docs/http/ngx_http_core_module.html#limit_except
#
#
#   - item.php5_include: ''
#       File to include instead of 'fastcgi_params', relative to /etc/nginx/
#
#       If set to False, nothing is included.
#
#
#   - item.php5_options: |
#       Additional options to append to php location, in text block format.
#
#
#   - item.php5_status: []
#       Optional. Enable php5 fpm server status page and allow access from list of
#       IP addresses or CIDR ranges.
#
#
#   - item.php5_status_name: ''
#       Optional. Set the name of the location which should be used for php5 fpm
#       status page
#
#
#   - item.php5_ping_name: ''
#       Optional. Set the name of the location which should be used for php5 fpm
#       ping page
#
#
#}
{% block nginx_tpl_block_index %}
        index {{ item.index | default('index.html index.htm index.php') }};

{% endblock %}
{% block nginx_tpl_block_location_root %}
                try_files {{ (([ item.try_files ] if item.try_files is string else item.try_files) if item.try_files|d() else ["$uri $uri/ $uri.php"]) | join(' ') }};
{% endblock %}
{% block nginx_tpl_block_custom_status_locations %}
{% if item.php5_status|d(nginx_php5_status) and (nginx_status or nginx_status_localhost) %}
        location ~ ^/({{ item.php5_status_name | default(nginx_php5_status_name) }}|{{ item.php5_ping_name | default(nginx_php5_ping_name) }})$ {
                access_log off;
{% if nginx_status_localhost %}
{% for address in nginx_status_localhost | unique %}
                allow {{ address }};
{% endfor %}
{% endif %}
{% if nginx_status %}
{% for address in nginx_status | unique %}
                allow {{ address }};
{% endfor %}
{% endif %}
{% if item.php5_status is defined and item.php5_status %}
{% for address in item.php5_status | unique %}
                allow {{ address }};
{% endfor %}
{% endif %}
                deny all;
                include fastcgi_params;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass {{ item.php5 }};
        }

{% endif %}
{% endblock %}
{% block nginx_tpl_block_custom_locations %}
{% if item.php5 is defined and item.php5 %}
        # CVE-2019-11043 mitigation (https://security-tracker.debian.org/tracker/CVE-2019-11043)
        # Based on: https://bugs.php.net/bug.php?id=78599
        rewrite ^(.*?)\n $1;
        location ~ ^(?!.+\.php/)(?<script_name>.+\.php)$ {
{% if (item.php5_limit_except is undefined or (item.php5_limit_except is defined and item.php5_limit_except)) %}
                limit_except {{ item.php5_limit_except | default('GET HEAD POST') }} { deny all; }

{% endif %}
                try_files $script_name =404;

{% if (item.php5_include is undefined or (item.php5_include is defined and item.php5_include)) %}
{% if (nginx_version is defined and nginx_version is version_compare('1.6.1','<')) %}
                include {{ item.php5_include | default('fastcgi_params') }};
{% else %}
{% if nginx_flavor in [ 'passenger', 'nginx.org' ] %}
                include {{ item.php5_include | default('fastcgi_params') }};
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
{% else %}
                include {{ item.php5_include | default('fastcgi.conf') }};
{% endif %}
{% endif %}

{% endif %}
{% if item.php5_options is defined and item.php5_options %}
                {{ item.php5_options | indent(16) | regex_replace("(?m)^\s*$", "") }}

{% endif %}
                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass {{ item.php5 }};
        }

        # CVE-2019-11043 mitigation (https://security-tracker.debian.org/tracker/CVE-2019-11043)
        # Based on: https://bugs.php.net/bug.php?id=78599
        rewrite ^(.*?)\n $1;
        location ~ ^(?<script_name>.+\.php)(?<path_info>/.*)$ {
{% if (item.php5_limit_except is undefined or (item.php5_limit_except is defined and item.php5_limit_except)) %}
                limit_except {{ item.php5_limit_except | default('GET HEAD POST') }} { deny all; }

{% endif %}
                try_files $script_name =404;

{% if (item.php5_include is undefined or (item.php5_include is defined and item.php5_include)) %}
                include {{ item.php5_include | default('fastcgi_params') }};
{% if (item.php5_include is undefined) %}
                fastcgi_param SCRIPT_FILENAME $document_root$script_name;
                fastcgi_param PATH_INFO $path_info;
{# This option doesn't work yet... #}
                #fastcgi_param PATH_TRANSLATED $document_root$path_info;

{% endif %}
{% endif %}
{% if item.php5_options is defined and item.php5_options %}
                {{ item.php5_options | indent(16) | regex_replace("(?m)^\s*$", "") }}

{% endif %}
                # Mitigate HTTPOXY attacks (https://httpoxy.org/)
                fastcgi_param HTTP_PROXY "";

                fastcgi_index index.php;
                fastcgi_pass {{ item.php5 }};
        }

{% else %}
        location ~ \.php$ {
                return 403;
        }
{% endif %}
{% endblock %}
