Question

I had a rare error in my Rails application. A CSS file was referring to non existing image files. And missing PNG file was somehow mapped to a controller action. Fortunately the action wasn’t changing DB. This seems to be not OK that missing PNG can trigger controller action.

So should I disable mod_rails for static asset directories? However I’ve never heard this is required for Rails apps.

Answer 1

It is definitely a good idea, since if you allow any kind of image upload the target destination is usually the asset directory. Normally the user can quite easily upload a php or ruby file instead, so disabling all mod_evil_script for these directories is a good idea in general.