PHP Includes in Apache Password Protected Directories

Question

(THIS IS A DUPLICATE, I FORGOT A TAG, PLEASE FORGIVE)

I'm writing a small CMS for a client using my own little framework and am running into one issue (not 100% sure it's an issue, but I'm sensing it will be).

So, for example, I have a News.php class that handles all of my Blog updates (CMS user input) and output (display of blog data on actual site). Now, because It makes me feel safer, I tuck all my classes that have to do with the CMS in a password protected "admin" folder.

The problem here arises when I need to utilize my nifty News.php class for the "View" layer of the site. I'm assuming since the class will be sitting in a password protected folder (admin/includes) anyone viewing the blog page will be prompted for the user and login for that folder in order to view the blog contents.

Is there a way of letting local files access password protected directories without being prompted for user and password info? (or does this happen?)

AND OR

Would you recommend storing my classes in a separate area of the site. I feel like the more locations I store my classes in the more complex my includes become, which can quickly turn into a nightmare. My ultimate goal would be to have ALL of my classes safely tucked away somewhere. Instead, as it is, I've been duplicating some classes for use outside or inside the admin directory.

Thanks in advance for the input.

Answer 1

You won't include files via apache so this password problem doesn't exist.

If you want to protect your includes, put them outside of the www root directory and nobody from the outside world will be able to access it.

Answer 2

The php include() function should be using the local file system, and thus is not bound by apache's .htaccess or other user access control mechanisms.

There should only be 1 copy of your class on the entire system. If it is used by both /admin and by the user portions perhaps you should create a /common folder to house these general purpose classes/functions. If a file containing only a php class is accessed directly nothing will happen. You could add a .htaccess deny from all if you are paranoid, or if you like using the .inc file extension which will spill source code to the attacker.