Re: .inc location security
| From: | Rasmus Lerdorf | Date: | Tue, 24 Apr 2001 21:17:01 +0000 |
| Subject: | Re: .inc location security | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-50173@lists.php.net to get a copy of this message | ||
> I tried to do the deny *.inc but doing so just made it so the browser can't
> even include them. So that won't do the trick.
Uh, what? Aren't these .inc files included by PHP scripts? PHP has no
way of knowing whether you are denying access to them from the httpd.conf
level with a proper deny rule.
For example, I have a site where I want all the *.inc files in my
DocumentRoot directory to be inacessible, but in other directories I want
them to be viewable. So I use a rule like this:
<LocationMatch "^/[^/]*.inc">
Order allow,deny
Deny from all
</LocationMatch>
Works perfectly.
-Rasmus