From 616d2b901ee0ffcf56798313777d5b211fe4c69b Mon Sep 17 00:00:00 2001
From: CrazyMax <github@crazymax.dev>
Date: Fri, 25 Oct 2019 15:15:35 +0200
Subject: [PATCH] Fix CVE-2019-11043 (#43)

---
 CHANGELOG.md                     |  4 ++++
 assets/tpls/etc/nginx/nginx.conf | 19 ++++++++++---------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4153da0..4b2c642 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.56-RC2 (2019/10/25)
+
+* Fix CVE-2019-11043
+
 ## 1.56-RC1 (2019/09/30)
 
 * LibreNMS 1.56
diff --git a/assets/tpls/etc/nginx/nginx.conf b/assets/tpls/etc/nginx/nginx.conf
index 0a2aebb..14ffd84 100644
--- a/assets/tpls/etc/nginx/nginx.conf
+++ b/assets/tpls/etc/nginx/nginx.conf
@@ -60,15 +60,6 @@ http {
     ## Serve already compressed files directly, bypassing on-the-fly compression
     gzip_static on;
 
-    ## FastCGI
-    fastcgi_index index.php;
-    fastcgi_param SCRIPT_FILENAME       $document_root$fastcgi_script_name;
-    include fastcgi_params;
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_buffers 256 4k;
-    fastcgi_intercept_errors on;
-    fastcgi_read_timeout 14400;
-
     server {
         listen 80;
         listen [::]:80;
@@ -85,7 +76,17 @@ http {
         }
 
         location ~ \.php$ {
+            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+            set $path_info $fastcgi_path_info;
+            try_files $fastcgi_script_name =404;
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $path_info;
+            fastcgi_index index.php;
             fastcgi_pass unix:/var/run/php-fpm7.sock;
+            fastcgi_buffers 256 4k;
+            fastcgi_intercept_errors on;
+            fastcgi_read_timeout 14400;
         }
 
         location ~ /\.ht {