Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I want the user to be able to run write "foo.phps" for a "foo.php" script in order to present the source of that file.

I only want to do this in one directory (since it's a security risk). Can I use .htaccess?

I added a .htaccess file to the directory and wrote this in it:

AddType application/x-httpd-php-source .phps

And then restarted Apache, but I can't add "s" to the file to get the source. Do I need to do something with PHP as well?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

From the php docs, you need to use a SetHandler

<FilesMatch "\.phps$">
    SetHandler application/x-httpd-php-source
</FilesMatch>
share|improve this answer

One way of solving this is you will need an additional script that simply outputs the source of the specified file. Then you can write a rewrite rule to rewrite

  • foo.phps

into

  • showmethesource.php?input=foo.php

One MAJOR issue with this is security. Make sure you can only output the desired files and not any file (like /etc/passwd) !!

share|improve this answer
    
Why use a potentially vulnerable script when there's built-in functionality to do it safely? –  ONOZ May 27 at 6:45

If you want to know if you can use a directive in a .htaccess in general, you can always consult the documentation. For Apache 2.0, see:

http://httpd.apache.org/docs/2.0/mod/mod_mime.html#addtype

Description: Maps the given filename extensions onto the specified content type
Syntax:      AddType MIME-type extension [extension] ...
Context:     server config, virtual host, directory, .htaccess
Override:    FileInfo
Status:      Base
Module:      mod_mime

In particular look at the "Context:" part.

In this specific case, yes, you can. You just need to make sure you allow overrides for FileInfo on that particular directory:

e.g.

<Directory /path/to/my/site>
    AllowOverride FileInfo
</Directory>

You also need to make sure the file EXISTS. If you have a file called test.php you can't just magically request test.phps

In order to solve that problem, you can either use mod_rewrite to force a handler. For example, this rule is in the mod_rewrite documentation as a good example of changing the handler in mod_rewrite

RewriteEngine On
RewriteRule ^(/source/.+\.php)s$ $1 [H=application/x-httpd-php-source]

or you could create a symbolic link but you will need to do that for every file manually (or script it) and for new files.

ln -s test.php test.phps
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.