up vote 0 down vote favorite
share [g+] share [fb]

I'm not sure this is possible, but I'd like to write a rewrite rule (and any other instruction if needed) in a .htaccess file so that, for every url in that folder, any url ending in .txt is rewritten to the same name ending in .php, but in addition, in this case the php file is NOT executed but its content (source code) is served instead.

That is, being "myfolder" the folder where I want this to apply:

http://www.mydomain.com/myfolder/somescript.php => would run somescript.php as usual http://www.mydomain.com/myfolder/somescript.txt => would return the source code of somescript.php without running it

link|improve this question
20% accept rate
Well I've solved this by writing a little php script and then rewriting xxxx.txt into getsource.php?file=xxxx.php Anyway I'm still curious about a solution that would not involve writing a php script to get the source. In my workaround, the rewrite rule is: RewriteRule (.*)\.txt$ getsource.php?file=$1.php and the php script getsource.php is like this: <?php $content=file_get_contents($_GET['file']); echo $content; ?> – matteo Dec 10 '11 at 19:16
2  
Look into highlight_file() (us2.php.net/manual/en/function.highlight-file.php) - your script is insecure, you need to perform sanity checking on the directory, someone could pass '../../db.php' to that script and get it output. – thinice Dec 10 '11 at 19:31
When hitting a PHP file post-rewrite, it should always be passed to the PHP handler - this is a very good thing for security reasons. – Shane Madden Dec 10 '11 at 19:32
feedback

1 Answer

up vote 2 down vote

There are two ways of accomplishing this.

  1. Symlink each .php file to .txt and add a directive in Apache like:

    AddType application/x-httpd-php-source .txt

    within a <VirtualHost>, <Location> or <Directory> block.

    Putting it inside a <Location> is probably best so that .txt files aren't globally associated as being PHP source.

  2. Use a rewrite rule such as:

    RewriteRule ^(/myfolder/.+)\.txt $1.php [H=application/x-httpd-php-source]

    (source: http://httpd.apache.org/docs/2.2/rewrite/flags.html#flag_h - modified slightly)

    With this option, ensure that no other files will exist in the directory called .txt otherwise they will be sent with a Content-type of x-httpd-php-source. You may need to adjust the regex if this is the case.

link|improve this answer
Do you mean to use that in conjunction with a rewrite rule such as RewriteRule (.*).txt$ $.php ? Or will the AddTyle alone accomplish what I described?? – matteo Dec 17 '11 at 18:18
The AddType alone should do it. You don't need any rewrite. application/x-httpd-php-source is part of mod_php. – James O'Gorman Dec 17 '11 at 22:21
No it doesn't. What it does is that existing txt files are served with the Content-Type header "application/x-httpd-php-source". What I asked was that by requesting somefile.txt you would obtain the source of somefile.php as plain text – matteo Jan 3 at 17:25
Ah. You didn't say you have existing .txt files you want to serve, just that foo.txt should return the source of foo.php. I don't think there is a way to do what you want. Usually people use .phps to get the PHP source. – James O'Gorman Jan 3 at 18:11
Even if I DON'T have txt files that I want to serve, your AddType declaration does not cause foo.txt to return the source of foo.php – matteo Feb 24 at 0:00
show 4 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.