The default file extension configuration has been changed to add .phar and...

The default file extension configuration has been changed to add .phar and remove (some) obsolete extensions

debian/libapache2-mod-php.NEWS

+php@PHP_VERSION@ (7.1.5-1) unstable; urgency=medium
+
+  * The configuration for handled file extensions has been changed:
+      + the .phar extension has been added
+      - the .pht, .php3, .php4 and .php5 extension has been removed
+
+    Now only .php, .phtml, .phar and .phps extensions are handled by
+    PHP in the default configuration.  Please make sure that this doesn't
+    cause any unintended consequences in your web roots.
+
+ -- Ondřej Surý <ondrej@debian.org>  Thu, 04 May 2017 11:44:05 +0200

debian/php-cgi.NEWS

+php@PHP_VERSION@ (7.1.5-1) unstable; urgency=medium
+
+  * The configuration for handled file extensions has been changed:
+      + the .phar extension has been added
+      - the .pht, .php3, .php4 and .php5 extension has been removed
+
+    Now only .php, .phtml, .phar and .phps extensions are handled by
+    PHP in the default configuration.  Please make sure that this doesn't
+    cause any unintended consequences in your web roots.
+
+ -- Ondřej Surý <ondrej@debian.org>  Thu, 04 May 2017 11:44:05 +0200

debian/php-cgi.conf

 # This file replaces old system MIME types and sets them only in the
 # Apache webserver
 
-# application/x-httpd-php                        phtml pht php
-# application/x-httpd-php3                       php3
-# application/x-httpd-php4                       php4
-# application/x-httpd-php5                       php
-<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
+# application/x-httpd-php                        phtml php
+<FilesMatch ".+\.ph(ar|p|tml)$">
     SetHandler application/x-httpd-php
 </FilesMatch>
 # application/x-httpd-php-source                 phps
@@ -17,7 +14,7 @@
     Require all denied
 </FilesMatch>
 # Deny access to files without filename (e.g. '.php')
-<FilesMatch "^\.ph(p[3457]?|t|tml|ps)$">
+<FilesMatch "^\.ph(ar|p|ps|tml)$">
     Require all denied
 </FilesMatch>
 

debian/php-fpm.NEWS

+php@PHP_VERSION@ (7.1.5-1) unstable; urgency=medium
+
+  * The configuration for handled file extensions has been changed:
+      + the .phar extension has been added
+      - the .pht, .php3, .php4 and .php5 extension has been removed
+
+    Now only .php, .phtml, .phar and .phps extensions are handled by
+    PHP in the default configuration.  Please make sure that this doesn't
+    cause any unintended consequences in your web roots.
+
+ -- Ondřej Surý <ondrej@debian.org>  Thu, 04 May 2017 11:44:05 +0200

debian/php-fpm.conf

@@ -6,7 +6,7 @@
     SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
     </IfModule>
 
-    <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
+    <FilesMatch ".+\.ph(ar|p|tml)$">
         SetHandler "proxy:unix:/run/php/php@PHP_VERSION@-fpm.sock|fcgi://localhost"
     </FilesMatch>
     <FilesMatch ".+\.phps$">
@@ -16,7 +16,7 @@
         Require all denied
     </FilesMatch>
     # Deny access to files without filename (e.g. '.php')
-    <FilesMatch "^\.ph(p[3457]?|t|tml|ps)$">
+    <FilesMatch "^\.ph(ar|p|ps|tml)$">
         Require all denied
     </FilesMatch>
 </IfModule>

debian/php.conf

-<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
+<FilesMatch ".+\.ph(ar|p|tml)$">
     SetHandler application/x-httpd-php
 </FilesMatch>
 <FilesMatch ".+\.phps$">
@@ -9,7 +9,7 @@
     Require all denied
 </FilesMatch>
 # Deny access to files without filename (e.g. '.php')
-<FilesMatch "^\.ph(p[3457]?|t|tml|ps)$">
+<FilesMatch "^\.ph(ar|p|ps|tml)$">
     Require all denied
 </FilesMatch>
 

debian/prepare-files

@@ -26,3 +26,6 @@ php@PHP_VERSION@.load
 php@PHP_VERSION@-xml.substvars.extra
 php@PHP_VERSION@-xml.postinst.extra
 php@PHP_VERSION@-snmp.substvars.extra
+php@PHP_VERSION@-cgi.NEWS
+php@PHP_VERSION@-fpm.NEWS
+libapache2-mod-php@PHP_VERSION@.NEWS