0

How do I restrict web access to parent folders of the main website directory. For example if I have the following directories/files:

/
├── home
│   └── user
│   │   ├── img.png
│   │   ├── script.js
│   │   └── page.html
└── var
    └── www
        └── index.html

and www.example.com points to /var/www/, I don't /var/www/index.html to be able to access any files outside, in this case, img.png, script.js, page.html.

A few extra notes:

  • I am using suPHP so I can't go around and change permissions/owners to restrict access.
  • suPHP does not work with htaccess files[1], so I can't go around and disable ../ for the top most folder(s) [2].
  • Symbolic links must also be ignored in case / is linked to in /var/www

1 Answer 1

1

It sounds like you need to enable the check_vhost_docroot option in order to ensure that the scripts is within DOCUMENT_ROOT:

check_vhost_docroot=true
2
  • Is this in the /etc/suphp/suphp.conf file? If so, would this also apply to, for example <script src="..."> statements?
    – puk
    Nov 7, 2011 at 4:12
  • It would only apply to PHP scripts (that is, anything accessed by suPHP). Anything else accessed by Apache (not suPHP) is read using the webserver user permissions.
    – MV.
    Jun 17, 2012 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .