Includes/direct access security problem.

[Fritz]

After hearing that folks can search google and get .inc file info
or knowing that someone might find my directories

AND noticing that IF I load them directly in a browser

PHP stuff IS DISPLAYED...

I am thinking that perhaps I could have apache parse .inc files through PHP like we already do with .html files...

I DO have apache parse all of my .html files AS php (and don't have a single file with .php on our site) - We are a very busy site and see no performance hit doing htis...

Thoughts?

[tsinka]

Hi,

two solutions, the second one is better:

1)

change AddType in httpd.conf from e.g.

AddType application/x-httpd-php .php .html

to

AddType application/x-httpd-php .php .html .inc

and restart apache

2) put all .inc files that are included by php scripts outside the document root and it's subdirectories (might be some work). They'll still work but there would be no way to access them directly (unless there's a security flaw in php that would allow that).