Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I tried to access my website recently and I saw something disturbing -- users could download the index.php file and see its contents, the PHP code!

How is this possible, for Apache to serve up PHP source instead of running the PHP source code? Is it because we were updating our website for maintenance?

I used this code:

ErrorDocument 503 "Our website is temporarily closed for maintenance. It should reopen by..."
RewriteEngine On
# TO ALLOW YOURSELF TO ACCESS THE SITE NORMALLY, SET THE NEXT LINE TO YOUR IP ADDRESS.
RewriteCond %{REMOTE_ADDR} !^111\.222\.333\.444$
RewriteRule .* - [R=503,L]

Now this message appears.

But how I can make it automatically appear when this happens again?

share|improve this question
6  
Please try rephrasing your question as a question. –  James Goodwin Jan 7 '10 at 16:57
    
now any one can copy my files in the server (php) –  moustafa Jan 7 '10 at 16:59
3  
And run it through spellcheck –  Mike B Jan 7 '10 at 17:00
add comment

migrated from stackoverflow.com Jan 7 '10 at 17:03

This question came from our site for professional and enthusiast programmers.

2 Answers

Apache wasn't "deleted" or "off", or else you wouldn't have been able to see the php source either. You can add the below codeblock to turn off serving .php files when php isn't loaded:

<IfModule !mod_php4.c>
    <FilesMatch "\.php$">
        Order allow,deny
        Deny from all
        Allow from none
    </FilesMatch>
</IfModule>
share|improve this answer
2  
php 4 ?! .. /shudder/ ... Please note this code will only cover php4; which you shouldn't touch with a barge pole anyway, as it is at end-of-life and therefore has had no security updates, or updates of any kind since december 2007 –  Cheekysoft Jan 12 '10 at 9:51
add comment

To answer the poster's comment posted as an answer, one of the following should work for the PHP5 module, depending on how it's installed (Sander Rijken's modified):

<IfModule !mod_php.c>
    <FilesMatch "\.php$">
        Order allow,deny
        Deny from all
        Allow from none
    </FilesMatch>
</IfModule>

Or,

<IfModule !mod_php5.c>
    <FilesMatch "\.php$">
        Order allow,deny
        Deny from all
        Allow from none
    </FilesMatch>
</IfModule>

Include only one of these two snippets, depending on which works for your configuration.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.