get php files from Directory Listing

Question

in my website there are PHP files that i include in other php files... they perform different tasks like connecting to my DB and various other functions... now i know the given path of my files.. so i can give the path like

http://www.mysite.com/myfiles/

this will give the directory listing of files in that directory..

i know to avoid the directory listing i will have put in a file name index.html OR index.php by doing so instead of directory listing

but still i know the path of file.. http://www.mysite.com/myfiles/con.php by doing this the code is executed but you can see the source OFFCourse because it is client side..

BUT is there a way to get that PHP file with its source code when somebody knows the path... ot will be security risk wouldn't it

Answer 1

Well, first of all, you should be able to disable the directory listing (thereby making it not necessary to pollute your directory tree with useless index.php files) by just adding the following line into a .htaccess file in your includes directory:

Options -Indexes

Now, with regards to users being able to get the php source code, as long as your webserver is set up correctly to interpret php files and not just serve them directly, you should be fine (assuming that your include files don't echo() any variables or something silly like that).

Answer 2

If you have AddType or SetHandler defined for PHP files, then it'll be interpreted by apache/webserver before serving to clients. So client won't see the php source, but only the html generated.

Answer 3

If I understand you correctly, you'd like to get the PHP source for people knowing the actual URL of the PHP file. You might use something like that, but remeber: it's no real security, so better don't include this in PHP files containing private stuff like DB user/password etc.

<?php
 if($_GET['hash'] === "jV1V-7-VhS09K-_77GtEoOd86K2-ba-W") {
   show_source(__FILE__);
 }
?>

This way only people knowing that "hash" (and evil people brute-forcing you) can get that source code by going to http://example.org/myfiles/con.php?hash=jV1V-7-VhS09K-_77GtEoOd86K2-ba-W.