0

The aim here is a security catch-all to disallow php execution of files created by the apache user (i.e. uploaded to a php script). Also we'd change the .html/.htm/.xhtml etc to text/plain to help protect against JS based attacks on other users.

Something like:

<FileOwnerMatch apache>
    #Disable PHP execution
    #change mime types
</FileOwnerMatch>

Can it be done?

NB We do check file extensions on uploads, but we'd like somethng akin to the above for added peace of mind.

Improve this question

1 Answer 1

Reset to default
0

You should make sure that Apache is only allowed to write into specific directories and disallow all execution for this directories (both CGI and PHP) with a <directory> statement.

Deactivating PHP can be done with a statement 

php_flag engine off

in the <directory> part of your Apache configuration.

Improve this answer
1
  • Yes, we already do something equivalent. But as mentioned in the original post this is a catch all safety net. Just in case there are 777 directories somewhere that we have missed, or that get created in the future.
    – DaedalusFall
    Aug 17, 2011 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .