RE: [PHP] Simple Security Clarification

As long as you have Apache properly configured with the AddType sending .php files to the PHP module, they are not going to be served up raw. On Fri, 23 Aug 2002, David Buerer wrote: > Anyone come up with a good way to disallow php files from being servered > directly? What i mean is this - all php files should be ONLY parsed by the > PHP parser. My fear is that there is some way that the user will be able to > actually download a PHP file directly therefore exposing all sorts of things > I don't want exposed. > > David > > -----Original Message----- > From: Justin French [mailto:justin@indent.com.au] > Sent: Wednesday, August 21, 2002 6:30 AM > To: aajdubuc@webhart.net; php-general@lists.php.net > Subject: Re: [PHP] Simple Security Clarification > > > If you can't store stuff ABOVE your doc root, you can protect them with a > .htaccess file. > > I use this to refuse all *.inc files from being served: > > <Files ~ "\.inc$"> > Order Allow,Deny > Deny from all > </Files> > > With this in mind, a quick visit to the Apache site should get you started > in the right direction. > > > Justin French > > > on 21/08/02 10:11 PM, Andre Dubuc (aajdubuc@webhart.net) wrote: > > > In another thread [How do you protect individual files], Justin French > stated: > > > > "In real short, you want to store the files outside your htdocs root (so > they > > can't be served by http) . . ." > > > > My PHP setup serves files from DOCUMENT_ROOT=/var/www/html. If I place > files > > in '/var/www/html/secure' would this provide any isolation for file > access? > > Am I correct in thinking that 'below' is not the same as 'outside' > doc_root, > > and that i this case, no protection would be afforded? > > > > Tia, > > Andre > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >