Re: security help

In addition, (if using .htaccess) They would only be able to read the .htpasswd from public directory if they had first authorised themselves. The browser will prompt them to identify before it allows files from a protected directory to be included. J. > Make sure that the .htpasswd file is BELOW the public files root. That way, > it can't be accessed through a browser, unless the person who has written > the file to try and read the .htpasswd has uploaded their file to the server > it resides on, and has permission to access that low level directory. They > can't read files in a directory route, unless they're in the directory: So > a URL reference won't work. If you've uploaded the .htpasswd to /www/admin > They could do an include for: > > <? > include(http://www.yoursite.com/admin/.htpasswd); > ?> > > ..................So: > > /home/myfiles/.htpasswd > > Rather than > > /home/myfiles/publicwwwfiles/.htpasswd > > Hope that's of some use to you. > James. > > ""Thor M. Steindorsson"" <thor@netwood.net> wrote in message > news:CGEILHNPHENDKFJOEGFKKEKGCOAA.thor@netwood.net... > > Should this be possible? > > I know this isn't an issue with php, but since I used php to do this, I > > figured maybe someone here has encountered the same thing, and knows how > to > > help. > > Is this something that can be fixed by making some changes on the linux > > server? > > > > By using this: > > > > <? > > echo "<pre>"; > > include("/home/someuser/www/admin/.htaccess"); > > echo "</pre>"; > > ?> > > > > I can see what .htpasswd file is used, and then I can simply change the > code > > to display that particular password file, then take the encrypted > password, > > and decrypt it to gain access to that protected area. > > > > I have a feeling this is a permissions issue on the Linux server... > > Can anyone point me in the right direction with this? > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > > For additional commands, e-mail: php-general-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >