0

Is there a way to set permissions on a directory or configure apache in a way that allows PHP to include files from this directory for execution but scripts cannot open them using fopen() or other similar functionality? I am trying to secure some keys, salts and whatnot that I don't want scripts to be able to reference or read directly.

2 Answers 2

1

There is no way to set up files so that PHP can include them but not read them via it's own APIs - it has to read them in order to include them.

What are you trying to achieve? Maybe the answer to your problem is obfuscation? Maybe the answer is to move them outside the document root, maybe the answer is to disable PHP parsing in the directory tree.

3
  • Tvanover probably wants to only allow script execution, not reading the code. This would allow for some kind of secret API then.
    – Lukas
    Mar 14, 2013 at 1:32
  • Mostly I want a place where I can store config info that only certain classes can read. Ideally that data would be in the class file, but those are easily read and parsed by other scripts. Especially since the file locations are easily predicted by simple rules.
    – Tvanover
    Mar 15, 2013 at 0:18
  • There's potentially lots of ways to achieve this - but your suggestion isn't one of them. Encrypt the files and push the authentication key out to the client / secure session. Use a secure session. Use multiple instances of PHP running under different uids with different permissions (suPHP / php-fpm with different pools)....
    – symcbean
    Mar 15, 2013 at 9:54
0

As symcbean already said, this is not possible with a single instance of PHP. However, you could try to spawn a 2nd PHP instance running as another user, also having access to other files.
Thinking about how to spawn this instance, that would be your job then.

Maybe PHP's integrated server would be an option - although it's still recommended for non-productive usage only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .