1

So I want the user to be able to run write "foo.phps" for a "foo.php" script in order to present the source of that file.

I only want to do this in one directory (since it's a security risk). Can I use .htaccess?

I added a .htaccess file to the directory and wrote this in it:

AddType application/x-httpd-php-source .phps

And then restarted Apache, but I can't add "s" to the file to get the source. Do I need to do something with PHP as well?

3 Answers 3

1

From the php docs, you need to use a SetHandler

<FilesMatch "\.phps$">
    SetHandler application/x-httpd-php-source
</FilesMatch>
2

If you want to know if you can use a directive in a .htaccess in general, you can always consult the documentation. For Apache 2.0, see:

http://httpd.apache.org/docs/2.0/mod/mod_mime.html#addtype

Description: Maps the given filename extensions onto the specified content type
Syntax:      AddType MIME-type extension [extension] ...
Context:     server config, virtual host, directory, .htaccess
Override:    FileInfo
Status:      Base
Module:      mod_mime

In particular look at the "Context:" part.

In this specific case, yes, you can. You just need to make sure you allow overrides for FileInfo on that particular directory:

e.g.

<Directory /path/to/my/site>
    AllowOverride FileInfo
</Directory>

You also need to make sure the file EXISTS. If you have a file called test.php you can't just magically request test.phps

In order to solve that problem, you can either use mod_rewrite to force a handler. For example, this rule is in the mod_rewrite documentation as a good example of changing the handler in mod_rewrite

RewriteEngine On
RewriteRule ^(/source/.+\.php)s$ $1 [H=application/x-httpd-php-source]

or you could create a symbolic link but you will need to do that for every file manually (or script it) and for new files.

ln -s test.php test.phps
0

One way of solving this is you will need an additional script that simply outputs the source of the specified file. Then you can write a rewrite rule to rewrite

  • foo.phps

into

  • showmethesource.php?input=foo.php

One MAJOR issue with this is security. Make sure you can only output the desired files and not any file (like /etc/passwd) !!

1
  • Why use a potentially vulnerable script when there's built-in functionality to do it safely?
    – ONOZ
    May 27, 2014 at 6:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .