views:

1830

answers:

5

Hi all!

I'm making a website which allows people to upload files, html pages, etc... Now I'm having a problem. I have a directory structure like this:

-/USERS
    -/DEMO1
    -/DEMO2
    -/DEMO3
    -/etc... (every user has his own direcory here)
-index.php
-control_panel.php
-.htaccess

Now I want to disable PHP, but enable Server-side includes in the direcories and subdirectories inside /USERS

Can this be done (and how :) )? Thanks in advance.

BTW, I use WAMP server

A: 

If you're using mod_php, you could put (either in a .htaccess in /USERS or in your httpd.conf for the USERS directory)

RemoveHandler .php

or

RemoveType .php

(depending on whether PHP is enabled using AddHandler or AddType)

PHP files run from another directory will be still able to include files in /USERS (assuming that there is no open_basedir restriction), because this does not go through Apache. If a php file is accessed using apache it will be serverd as plain text.

Edit

Lance Rushing's solution of just denying access to the files is probably better

Tom Haigh
I use mod_php, but this does not work, sorry.
Time Machine
+1  A: 

To disable all access to sub dirs (safest) use:

<Directory full-path-to/USERS>
     Order Deny,Allow
     Deny from All
 </Directory>

If you want to block only PHP files from being served directly, then do:

1 - Make sure you know what file extensions the server recognizes as PHP (and dont' allow people to override in htaccess). One of my servers is set to:

# Example of existing recognized extenstions:
AddType application/x-httpd-php .php .phtml .php3

2 - Based on the extensions add a Regular Expression to FilesMatch (or LocationMatch)

 <Directory full-path-to/USERS>
     <FilesMatch "\.(php3?|phtml)$">  
         Order Deny,Allow
         Deny from All
     </FilesMatch>
 </Directory>

Or use Location to match php files (I prefer the above files approach)

<LocationMatch "/USERS/.*\.(php3?|phtml)$">
     Order Deny,Allow
     Deny from All
</LocationMatch>
Lance Rushing
+1  A: 

This might be overkill - but be careful doing anything which relies on the extension of PHP files being .php - what if someone comes along later and adds handlers for .php4 or even .html so they're handled by PHP. You might be better off serving files out of those directories from a different instance of Apache or something, which only serves static content.

Dominic Rodger
People cannot edit or upload .htaccess files. Offcourse
Time Machine
@Nevermind - I'm not talking about your users. I'm talking about you, or some other sys-admin 2 years down the line.
Dominic Rodger
+5  A: 

Try to disable the engine option in your .htaccess file:

php_flag engine off
Gumbo
What happens when someone browses to file in the web browser? Does the source code show?
Lance Rushing
@Lance Rushing: The file’s content will be send to the client. But why don’t you just try it yourself to see what happens?
Gumbo
@Lance: This really doesn't matter. Trust me, I really do tell the user he can't use PHP =P
Time Machine
A: 

This will display the source code instead of executing it:

<VirtualHost *>
    ServerName sourcecode.testserver.me
    DocumentRoot /var/www/example
    AddType text/plain php
</VirtualHost>

I used it to enable other co-workers to have read access to the source code (just a quick alternative).

lepe