Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a sub-directory within the html/ doc root that users need to upload images to. I need to set up something so that no scripts (php) can be executed within this directory. There will be multiple users uploading images to this directory but just in case one of their accounts is compromised I'd like to add some added protection so that a malicious script cannot be executed. The directory is only for serving up images. Any suggestions?

share|improve this question

3 Answers 3

You want something like:

<Directory /foo/bar>
  [other directives for this dir]
  AddHandler default-handler .php 
</Directory>
share|improve this answer

Fixed. I added the following new directory container to the Apache.conf file for the specific directory:

<Directory /www/sites/www.example.com/html/images>
RemoveHandler .php .phtml .php3 .php5
RemoveType .php .phtml .php3 .php5
php_flag engine off
</Directory>

source: http://www.phpfreaks.com/forums/index.php?topic=354749.0

share|improve this answer

Use AddHandler in a <Directory> section to force PHP scripts to go through default-handler.

share|improve this answer
    
can you please clarify? –  SoMoSparky Mar 12 '12 at 21:08
    
... Which part? –  Ignacio Vazquez-Abrams Mar 12 '12 at 21:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.