Re: PHP shell commands
| From: | Lucas Prado Melo | Date: | Fri, 11 Jan 2008 21:46:43 +0000 |
| Subject: | Re: PHP shell commands | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-267121@lists.php.net to get a copy of this message | ||
On Jan 11, 2008 2:16 PM, Daniel Brown <parasane@gmail.com> wrote:
> Make sure you change the permissions on the directory in which
> uploads are saved to be non-readable by anyone (including yourself, in
> case the scripts are suexec'd).
>
> For example, if the directory in which you save uploaded files is
> uploads/ then just do this (on a *nix box):
> chmod 300 uploads
>
> That way, files can still be saved to the directory (which
> requires write and execute privileges), but the files cannot be read
> or executed via the web, and directory listing is implicitly denied
> for all protocols (and local access) to anyone except root.
The uploaded scripts must be executed via the web because it's a host...
Maybe we could prevent scripts from certain folders to see other
folders... (chroot?)
Do you know how to do it in apache?