I want to make my txt file safe.

Question

Current status. I have to set 606 for my foobaa.txt.

I wrote a php code, that read and write foobaa.txt,

and I want to make the permission of the foobaa.txt as 600.

But when I tested 600, the PHP code can not read and write foobaa.txt.

so I changed to 606 the foobaa.txt, then my PHP code can read and write the foobaa.txt.

this is problom, because

when someone put

ttp://blabla.foobaa.com/foobaa.txt

directly, then he can see the contents of the foobaa.txt.

This is security hole.

so I want to make 600 for the permission of the foobaa.txt, but if I do so, then the php code can not read and write foobaa.txt.

I think the admin can modify some apatch settings for we can set the txt file's permission as 600.

or do I have to do some other things?

like .htaccess or something.

Answer 1

You could restrict access through .htaccess:

<Files foobaa.txt>
    Deny from all
</Files>

or something similar. But this isn't perfect... better would be moving the file outside your public_html (or equivalent) folder.

Answer 2

Your PHP code runs as the web server, not the user that is SSH'ing into the account and changing the permissions. So if the text file is readable by the script, it is readable by the server. You will want to control outside users' access to the file by one of a couple of methods.

1. Put the file outside your DocumentRoot, so that the script can access it, but it's impossible to request by HTTP.

2. Put the file in a directory with a .htaccess file that reads simply Deny From All. You could also protect the file individually, but it's likely that you'll have other, related files that should be kept private. You can just put those in the same directory.