TubeAce exploits

[cd34]

If you are running tubeace, the following rules should be added to your webserver config. Doing it in .htaccess doesn't help as they are able to override that. This assumes Apache 2.x.

<Directory /var/www/domain.com/avatars/>
AllowOverride none
RemoveHandler cgi-script .cgi .py .pl
<FilesMatch "\.php$">
  SetHandler none
</FilesMatch>
</Directory>
<Directory /var/www/domain.com/cache/>
AllowOverride none
RemoveHandler cgi-script .cgi .py .pl
<FilesMatch "\.php$">
  SetHandler none
</FilesMatch>
</Directory>
<Directory /var/www/domain.com/thumbs/>
AllowOverride none
RemoveHandler cgi-script .cgi .py .pl
<FilesMatch "\.php$">
  SetHandler none
</FilesMatch>
</Directory>
<Directory /var/www/domain.com/uploads/>
AllowOverride none
RemoveHandler cgi-script .cgi .py .pl
<FilesMatch "\.php$">
  SetHandler none
</FilesMatch>
</Directory>