Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've created a public directory where people can upload files to and I'd like to disable any kind of file parsing in that directory, i.e. disable php file parsing, .htaccess, etc. The directory should only contain images and compressed archives.

I was wanting to use the RemoveHandler, but I'd like a simple way to disable all the security threats.

Currently I'm using this but I wonder if this is enough:

<Directory "/var/www/dir">
Options Indexes FollowSymlinks
AddHandler default-handler php pl py
AllowOverride None
</Directory>
share|improve this question

1 Answer 1

just

SetHandler default-handler

instead of AddHandler should be more generic [ especially that probably your web server/mod-php will happily execute .php3 and .php5 files. maybe even .phtml ].

interestingly such syntax of SetHandler but apparently works for me [ found via: this one ]

i'd also change Directory into Location so it's not bound to some branch of your filesystem, but rather virtual directory in apache's url. - just in case..

you might also add

DirectoryIndex index.html

in case someone wanted to host circa '95 all-static webpage...

share|improve this answer
    
That's also the link I found, which taught me about SetHandler. I tried AddHandler at first but it didn't respect my Options Indexes FollowSymLinks configuration, it gave me a "not found" error instead when trying to view the contents of the directory. Oh, and my server only executes .php files. –  EarthMind Dec 16 '09 at 21:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.