2

Hi not sure if this is the correct forum but I am wondering about preventing execution of certain file types in a particular directory. A quick google search indicates that an htaccess file containing...

Options -ExecCGI
php_flag engine off
SetHandler none
SetHandler default-handler
RemoveHandler .cgi .php .php3 .php4 .php5 .phtml .pl .py .pyc .pyo

should do the trick. What I am wondering does this still allow php files in other directories to perform actions on files in that directory. For example the directory has images in it and there is an a php file contained in another directory that creates thumbnails of those images and stores them within the original directory.

2

2 Answers 2

0

I use in Centos 6.10 for multiple folders in virtual host .conf definitioin file:

<DirectoryMatch ^/var/www/mysite/htdocs/(nophpexecutefolder1|nophpexecutefolder2)>
       php_admin_value engine Off
</DirectoryMatch>

However, even though it doesn't parse php code the usual way it still outputs from a .php things such as variable declarations and text when doing echo e.g.

<?php

echo "<strong>PHP CODE EXECUTED!!";

$a=1;
$b=2;

echo $a+$b;

The above produces in web browser?

PHP CODE EXECUTED!!"; $a=1; $b=2; echo $a+$b;

This could potentially expose some code to users which isn't ideal. The same happens when use OP's code.

Therefore, it's probably best to use the above in combination with the following in .htaccess:

<FilesMatch ".*.(php|php3|php4|php5|php6|php7|php8|phps|pl|py|pyc|pyo|jsp|asp|htm|html|shtml|phtml|sh|cgi)$">
 Order Deny,Allow
 Deny from all
  #IPs to allow access to the above extensions in current folder
  # Allow from XXX.XXX.XXX.XXX/32 XXX.XXX.XXX.XXX/32
</FilesMatch>

The above will prevent access to any of the above file extensions but will allow other extensions such as images, css etc. to be accessed the usual way. The error when accessing .php:

Forbidden

You don't have permission to access /nophpexecutefolder1/somefile.php on this server.
-1

you have to log on to the server machine and actually see what owner:group the files have and as what user the apache runs.

Typically it runs as www-data

now if the folders and files are owned by the apache server (e.g. their ownership is set to www-data) then the server can do whatever it wants to all the files.

to make the files secure i recommend this:

set the owner of all files folders to: someuser where someuser is not www-data but can be root.

set the group to www-data

remove all write access to all files and folders from www-data/the group. Obviously as well from the other (linux permissions is owner:group:other)

leave write access to the upload folder, but remove script execution from that folder.

that's it. Whenever u want to install a plugin or change a file, you eventually have to quickly change the permissions in order to do so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .