I'm tasked with maintaining a LAMP webserver that has been victimized already by some PHP programmers that have never heard of SQL injection, CSRF, or similar topics. There are several world-writable directories to which these PHP scripts are supposed to be used to upload images. Of course, they can also be used to upload PHP scripts, like web shells.

Is there an Apache module or directive that can turn off the PHP engine for any directory it encounters that is writable by apache?

safe_mode, ugly hack though it is, has been enabled on the sites in question. But beyond that I am refusing to take responsibility for auditing or touching a single line of these atrocious PHP scripts themselves.


The easiest way is to put php_flag engine off in an .htaccess file in that directory. The "engine" directive is only supported in php 4.0.5 or later.

You can also try and remove the handlers in apache using .htaccess (e.g RemoveHandler .php), but I'd try the other one first. Removing the handler is one of those "force it to break" methods that sometimes backfire.

  • hmm, well that would work for now. And actually I was just working on a set of DirectoryMatch blocks that does the same thing. But if they create a new directory tomorrow that's world-writable, I'd have to be aware of it and manually add the .htaccess or DirectoryMatch... not gonna happen... – user53710 Sep 8 '10 at 20:13
  • 1
    @sbeam: Then reverse it. Set it to php_flag engine off in your httpd.conf, and then put .htaccess files turning it on in the directories you want them to be running their scripts from. Remember that's what .htaccess is for: local directory permissions. – Satanicpuppy Sep 9 '10 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.