Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do I restrict web access to parent folders of the main website directory. For example if I have the following directories/files:

/
├── home
│   └── user
│   │   ├── img.png
│   │   ├── script.js
│   │   └── page.html
└── var
    └── www
        └── index.html

and www.example.com points to /var/www/, I don't /var/www/index.html to be able to access any files outside, in this case, img.png, script.js, page.html.

A few extra notes:

  • I am using suPHP so I can't go around and change permissions/owners to restrict access.
  • suPHP does not work with htaccess files[1], so I can't go around and disable ../ for the top most folder(s) [2].
  • Symbolic links must also be ignored in case / is linked to in /var/www
share|improve this question

1 Answer 1

It sounds like you need to enable the check_vhost_docroot option in order to ensure that the scripts is within DOCUMENT_ROOT:

check_vhost_docroot=true
share|improve this answer
    
Is this in the /etc/suphp/suphp.conf file? If so, would this also apply to, for example <script src="..."> statements? –  puk Nov 7 '11 at 4:12
    
It would only apply to PHP scripts (that is, anything accessed by suPHP). Anything else accessed by Apache (not suPHP) is read using the webserver user permissions. –  MV. Jun 17 '12 at 8:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.