include? SSI? file permissions...help!

sleeping_sloth

Hello everyone...

I've been developing a simple SQL database accessed using PHP. My problem is that I need to prevent users accessing particular files (.htm and .swf) directly using a browser. To this end, I have used an INCLUDE command to call the relevant file(s) from inside the PHP. However, no matter what way I try to set-up the access permissions on the directories involved, I am left with either a totally non-secure directory, or one that I can neither view by browser or via PHP. Can anyone offer any help on this subject? I'm tearing my hair out!
Thanks all,
Sleeping_Sloth

Pig

Can't you do that with .htaccess? Not sure how PHP could do that.

Bunkermaster

.htaccess + .htpassword on include directory

PHP can access but not user (unless he has the password)

sleeping_sloth

Thanks for the quick response!

I have tried using .htaccess to prevent direct browser-access to the files I want to keep protected. The entry looks like this:

<Files *>
order allow,deny
deny from all
</Files>

but this prevents a connection to the files from either a web browser or from the PHP include - could someone please give me details on setting up a .htaccess file that will allow the include but prevent browser access? - and if that requires a .htpassword file, how I would go about adding the password authentication into my PHP (if that is how it works)

Thanks again!
Sleeping_sloth

Bunkermaster

AuthType Basic
AuthName "Not for your eyes"
AuthUserFile /home/sites/www.domain.com/web/includes/.htpasswd

require valid-user

There you go (generate the password with htpasswd in apache bin)

sleeping_sloth

First, thanks bunkermaster for the help - I appreciate it, as I am pretty new to this, and though I have spent a long time trying to solve this problem (and searching on the web), there doesn't seem to be a lot of relevant information.

I have set up exactly as you suggest - managed to sort the .htpasswd file, but I can still look at particular files within the directory, just not list the contents of that directory in the browser.

I literally copied and pasted your .htaccess suggestion (with directory name changed) into the .htaccess file in the directory I want to protect, which is also where the .htpasswd file is (for now at least).

Is there any reason why I can still view a single file?

Thanks
Sloth out

Okay - I've got it sorted - sorry about that - me being stupid really.....I didn't have permissions set, so I was assuming it had rejected my password attempt - it hadn't though. I'll be back if I have further problems!
Cheers agai

Sleeping_sloth

sleeping_sloth

Hello again!

Okay, I've set things up as per your suggestions, and I am having problems - even though the .html file is being included, and not called by an "<a href>" or something, I am still unable to get to it without entering username and password - so I have the same problem I had before, essentially.
Is there something I'm missing? I've got .htpasswd and .htaccess in the relevant directory, referencing correctly, blah blah.

Thanks,
Sleeping_sloth