[YvesCesar]

default.conf sent every *.php request to PHP-FPM except under wp-content/uploads and vendor folders. Any PHP file that ended up anywhere else in the document root (the root itself, wp-content/cache, wp-content/languages, inside a plugin or theme) was executed, and files such as .phtml or .PHP were served as plain text. XML-RPC was enabled unless the deployment set WORDPRESS_XMLRPC_ENABLED=0, and wp-admin/install.php stayed open until the browser setup was completed.

Changes

• The fastcgi block moves to .docker/nginx/snippets/php-fpm.conf, mounted at /etc/nginx/snippets/.
• Only the WordPress entry points go to PHP-FPM: index.php, wp-login.php, wp-cron.php, wp-comments-post.php, wp-signup.php, wp-activate.php, wp-trackback.php, wp-links-opml.php, the scripts directly under wp-admin/ (plus wp-admin/network/ and wp-admin/user/) and wp-includes/js/tinymce/wp-tinymce.php. Any other .php, .php[0-9], .phtml, .phar or .pht path returns 404, case-insensitively. The existing 403 rules for uploads and vendor stay in front.
• WORDPRESS_XMLRPC_ENABLED now defaults to 0. When enabled, the generated file serves xmlrpc.php through the snippet.
• New 41-web-install.sh: install.php and setup-config.php return 404 unless WORDPRESS_WEB_INSTALL_ENABLED=1 is set on nginx.
• The entrypoint runs wp core install on the first start when WORDPRESS_SITE_URL, WORDPRESS_ADMIN_USER, WORDPRESS_ADMIN_PASSWORD and WORDPRESS_ADMIN_EMAIL are set (WORDPRESS_SITE_TITLE is optional).
• README documents the allowlist, the two switches, the install variables and how to allow a single plugin endpoint with a location ^~ in server.d.

Deployments that relied on XML-RPC, on the browser installer or on a plugin PHP file reached directly need to enable it explicitly.

Tests

tests/security/php-allowlist.bats runs the real config against PHP-FPM. It fails on main (unknown PHP at the root, under wp-content/cache, languages, plugins and themes, .phtml/.PHP, wp-config.php, wp-admin/includes, wp-includes and the installer all reach PHP or leak the source) and passes here. The XML-RPC, server snippet and vendor tests were updated to the new defaults. bats tests/security: 31/31; ShellCheck clean; image builds.

Also checked on a fresh stack started from this branch with WooCommerce: install through the new variables, front page, wp-login.php for admin and customer, wp-admin pages, admin-ajax.php, admin-post.php, load-scripts.php, /wp-json/, the Store API, wp-cron.php, cart, checkout with an order placed, and My Account with the orders list all work.

[vitormattos]

Have conflicts