0

I'm a web hoster and a site owner.

As a hoster I wan't to disable the use of some module directives within the .htaccess for my customers sites.

Since some sites serves as a CDN, I want to disable for example AddHandler (and a few more) from mod_mime. So that even if php files are uploaded, they can't execute.

While directives like RewriteRule from mod_rewrite is still good to have.

To explain it in pseude code:

AllowOverride All -mod_mime -DocumentRoot -CustomLog -ErrorLog

The document https://httpd.apache.org/docs/2.2/mod/mod_mime.html#AddHandler says the Context is .htaccess, could I limit the Context of this module directive? I'm not afraid of patching or recompiling it.

How would I solve this? Thanks!

1

The answer were right under my nose, literally.

You will need Apache 2.4 however

https://httpd.apache.org/docs/current/mod/core.html#allowoverridelist

Set

<Directory /var/www/vhosts>
    AllowOverride None
    AllowOverrideList RewriteEngine RewriteOptions RewriteBase RewriteCond RewriteRule
    Require all granted
</Directory>

Will allow only those directives specified within the AllowOverrideList. All others will cause an internal server error.

Doing the same for whole modules is still missing though, but this is a good enough solution for me.

Thanks again SF

0

DocumentRoot, CustomLog and ErrorLog are already not available in .htaccess, so that's not a problem.

As far as I know, there's no way to disable all of mod_mime specifically. You would have to disable all of FileInfo, which may not be what you want.

<Directory /var/www/vhosts>
   AllowOverride  All -FileInfo
   RemoveHandler .php
</Directory>
  • Ah, of course. I just used them for explaining. But patching and recompiling the module would be an option hopefully, was maybe an SO question after all. Thanks anyway :) – Arceus May 23 '13 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.