Denying Browser Access to ".inc" Files

Kilo

Hello all,

I've got a bunch of .inc files in a Php application. If I point my browser at them, it displays the contents in the browser, something I want to avoid. How do I config apache so it won't do this?

Thanks in advance.

Weedpacket

Two common methods are to configure Apache to treat them the same way it treats PHP files, or just name them with a .php extension instead of a .inc one. If they don't produce any output when run on their own all anyone will get if they request them is a blank screen.

Kilo

Thanks for that, seems to have done the trick. 🙂

However, this leads me to another question. At the moment, if you point the browser at a directory, you receive a list of all the files in that directory. I've worked out how to stop it showing .inc files in this list, but I'd rather turn it off all together.

I'm sure this has been asked a thousand times before, but I'm sorry to have to ask: how do I turn off directory listings?

In httpd.conf there a section that starts:

#
# FancyIndexing is whether you want fancy directory indexing or standard
#
IndexOptions FancyIndexing

etc. Is there a value for IndexOptions that works, or am I barking up the wrong tree? 😕

Kilo

I'm also trying to turn off directory listings on a cobalt which doesn't seem to have the above section in httpd.conf. Any ideas?!

paul088

To prevent files in a directory from being seen, put an empty index.html (or index.htm, default.htm, index.php) in the directory.

Kilo

That's a good short term fix, but I've it's quite a large and growing application, and I'm looking for one apache setting so I don't have to worry about doing it again.

I appreciate the response though. 🙂

laserlight

Apparently it is possible to specify

IndexIgnore *

in your htaccess file to prevent listing of the directory in which the htaccess file resides.
I have never tried it though.

csousley

http://www.oreillynet.com/pub/wlg/97

You should read the entire page, they cover a few topics and this on is not on top...

Hope this helps.

elToro

Another way to keep folks from seeing the .inc files is to put them in a directory outside the www root. If necessary, you can use .htaccess to set your include path appropriately.

csousley

http://www.tortuga.com.au/resources/apache.html

another site to check