Question

vboyz

I have a file that have sensitive information like passwords. It's inside the www folder, which anyone can see if they know its location. How can I restrict the access only to my script? I can't place my file outside the directory www because it's not my server. Any ideas, suggestion?

the_Igel

Let's suppose that your main script is index.php and file with passwords is pass.php.

Then just put these lines on top of pass.php:

if (!preg_match('/index.php/', $_SERVER['PHP_SELF']))
{
header('Status: 404 Not found');
exit;
}

Rohan_Hill

But chances are the password file isn't a PHP script. You could Chmod it so that "others" can't read the file.

Weedpacket

To further Rohan Hill's suggestion: give it a .php extension. Then if it is requested, PHP will parse and execute it - and since it (presumably) doesn't generate any output (and I guess just sets a bunch of variables), all the client would receive is a blank page. That, of course, is assuming they even know it's there and what its name is so that they can request it.

the_Igel

It's OK in case they are set like

define('PASSWORD', 'secretWord123');
$another_password = 'SomeThingOneShouldKnow4ever';

But then if they are just

123rwfwtery
sqwjgy4358dfjk
FhGFkGH

then they will be printed. It all depends on wanted format for these data.
And I'm not very experienced with access privileges and stuff, but if I chmod the file to smth restrictive, isn't there a chance the script won't be able to access it? Script usually runs with webserver privileges, doesn't it?

Weedpacket

Yeah, PHP (at least when it's running as a server module) runs on the server's account; so for PHP to read it, the server must be allowed to read it as well. Of course, with a suitable .htaccess it may well be possible to get the server to do something other than just dump the file contents to the client.

As you say, it depends on the format of the given file whether my method will work or not.