1
  1. Can I use an includes folder on one website and set up "trusted domains/IPs" that are allowed to access the files in this folder (all other domains/IPs are restricted)? All the sites are on the same shared hosting server, the global site has a dedicated IP, the others share a different IP.

  2. Is this too insecure to allow PHP includes across domains?

  3. If this scenario is not possible to configure, are there some alternatives to share server-side files globally and relatively securely?

Edit: Server is Apache

When including files across domains it gives the error:

Warning: include(/home/user1/public_html/file.php) [function.include]:
failed to open stream: Permission denied in /home/user2/public_html/file.php
  • What web server is this? – Sam Cogan Oct 22 '09 at 9:18
2

If all the websites are on a shared server you can make a folder readable and they can include that way. Say /blah/globalphpshare/ and user 'homer' wants to use greet.php he/she could simply do include("/blah/globalphpshare/greet.php");

  • Yes. The includes are done locally through the filesystem, nothing has to do with domains or IPs. I would go with MrStatic's solution. If you can't get access to something logical (I like to put site-wide PHP stuff in /usr/local/share/php) you could just try to make sure that /home/user1/public_html/file.php and the directories above it are world readable. – Jason Antman Oct 22 '09 at 13:06
1

If your host enables webroot protection in apache, the file system path will not work, but you may still be able to include like this:

<?php include('http://www.somedomain.com/?query=string'); ?>

The main differences are that the included file only sees the variables you passed it in the string, and what is returned is the HTML that php parsed out of the file on the source domain. Depending on what's in the included file, that may be okay.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.