RE: [PHP] way to protect .php file

Just to add, if it is possible for user to "get out his own box" then your whole server is under huge risk. People will start including each-other's files, reading your httpd.conf (a show_source('/usr/local/apache/conf/httpd.conf') is enough, even highlighted! Same to every other file on your machine) A user MUST NOT be able to get lower or parallel "/home/username" Sincerely, Maxim Maletsky Founder, Chief Developer PHPBeginner.com (Where PHP Begins) maxim@phpbeginner.com www.phpbeginner.com -----Original Message----- From: Maxim Maletsky Sent: Thursday, May 17, 2001 2:26 PM To: 'Kittiwat Manosuthi'; php-general@lists.php.net Subject: RE: [PHP] way to protect .php file no no and no. You can chown the whole directory with it's contents to a specific user using that directory. In this way no cd is possible. This should be done automatically when creating user accounts. There are even softwares to do that - they create you a directory, user, group, add vhost and reboot apache. This kind of things is easy to avoid by organizing permissions rules between server users. Sincerely, Maxim Maletsky Founder, Chief Developer PHPBeginner.com (Where PHP Begins) maxim@phpbeginner.com www.phpbeginner.com -----Original Message----- From: Kittiwat Manosuthi [mailto:mailing_list@hostpacific.com] Sent: Thursday, May 17, 2001 2:08 PM To: php-general@lists.php.net Subject: [PHP] way to protect .php file In a virtual hosting environment, even though a directory permission is set to 751, but you still need to leave world-readable permission on individual php file that is to be read from a browser. In a scenario where there's another user in the same server who can guess (or even get, from URL) the name of php files, he can simply: cd /home/user1/html; more thatfile.php. If thatfile.php contains username/pwd to a db, this can lead to a compromise on that db. Moreover, many times that db name is the same as username, as well as db pwd is the same as user password! Is there anyway one can protect this? Thanks -kittiwat -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net