Fix #352 - Block PHP scripts in Nginx for uploads

[erikbelusic]

Prevent php scripts from being accessed or executed inside the app/uploads folder and any subdirectories by adding an nginx directive to the wordpress.conf.

This has been tested to return a 403 error for any file with a .php extension in app/uploads or any subdirectory of uploads. Assets with any other extension are not affected and can be accessed as normal.

[retlehs]

use 2 spaces instead of 4

[erikbelusic]

done and done! i shouldn't have did this on my master branch though....right? i should have made a feature branch?

[swalkinshaw]

@erikbelusic yeah you probably have created a branch but it's not a big deal. You can always re-create your fork.

One more thing: we usually like to keep PRs to a single commit (unless there's a reason for more) to keep our Git history clean. Would you be able to squash these two commits into one? We can provide instructions if you haven't done it before.

Although I just realized that's the best reason to do work on a feature branch since you need to force push after a rebase/squash and obviously you should avoid that on master :)

[erikbelusic]

@swalkinshaw i have not done it before. please provide guidance =]

[erikbelusic]

@swalkinshaw i think i got it. let me know if it turned out correctly.

[swalkinshaw]

@erikbelusic perfect! Thanks.

[erikbelusic]

@swalkinshaw now that this has been merged, can i delete and refork to make any additional contributions on feature branches without messing this up?

[swalkinshaw]

@erikbelusic yep I'd definitely do that.

[louim]

@erikbelusic No need to delete.

Assuming you named the upstream (this remote) upstream:

git fetch --all
git reset --hard upstream/master
git push -f