RE: [PHP] Simple Security Clarification

Anyone come up with a good way to disallow php files from being servered directly? What i mean is this - all php files should be ONLY parsed by the PHP parser. My fear is that there is some way that the user will be able to actually download a PHP file directly therefore exposing all sorts of things I don't want exposed. David -----Original Message----- From: Justin French [mailto:justin@indent.com.au] Sent: Wednesday, August 21, 2002 6:30 AM To: aajdubuc@webhart.net; php-general@lists.php.net Subject: Re: [PHP] Simple Security Clarification If you can't store stuff ABOVE your doc root, you can protect them with a .htaccess file. I use this to refuse all *.inc files from being served: <Files ~ "\.inc$"> Order Allow,Deny Deny from all </Files> With this in mind, a quick visit to the Apache site should get you started in the right direction. Justin French on 21/08/02 10:11 PM, Andre Dubuc (aajdubuc@webhart.net) wrote: > In another thread [How do you protect individual files], Justin French stated: > > "In real short, you want to store the files outside your htdocs root (so they > can't be served by http) . . ." > > My PHP setup serves files from DOCUMENT_ROOT=/var/www/html. If I place files > in '/var/www/html/secure' would this provide any isolation for file access? > Am I correct in thinking that 'below' is not the same as 'outside' doc_root, > and that i this case, no protection would be afforded? > > Tia, > Andre > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php