default mime type setting in apache creates security problem

[jackc]

Seems default setting in apache is not safe


<IfModule mod_php4.c>
AddType application/x-httpd-php .inc .php .php4 .php3 .phtml
AddType application/x-httpd-php-source .phps
</IfModule>
<IfModule mod_php3.c>
AddType application/x-httpd-php3 .php3
AddType application/x-httpd-php3-source .phps
</IfModule>
<IfModule mod_php.c>
AddType application/x-httpd-php .phtml
</IfModule>


which will run a.php.mht as php. hackers can find a way to upload a none-php file such as use buggy forum software and gain control of the hosting account.

change the setting to something like this can solve the problem.


<IfModule mod_php4.c>
<FilesMatch "\.(php|inc|php4|php3|phtml)$">
AddType application/x-httpd-php .inc .php .php4 .php3 .phtml
AddType application/x-httpd-php-source .phps
</FilesMatch>
</IfModule>
<IfModule mod_php3.c>
<FilesMatch "\.(php3)$">
AddType application/x-httpd-php3 .php3
AddType application/x-httpd-php3-source .phps
</FilesMatch>
</IfModule>
<IfModule mod_php.c>
<FilesMatch "\.(phtml)$">
AddType application/x-httpd-php .phtml
</FilesMatch>
</IfModule>


What do you guys think? is this enough or there is a better way?