file access problem

[jerry_louise]

file access problem
Hey i am running a site of apache and dispite my best efforts my friend can always tell me the password in http://absolutionguild.net/include/constants.php though i have banned access to it in a .htaccess file

// ht access file
<Files constants.php>
order allow,deny
deny from all
</Files>

Any sugestions of further protecting it.

[NogDog]

Have you asked this "friend" to tell you how he is getting it? It does not appear to be directly accessible via HTTP, but if he has FTP access or can run another script on that host that can read files from that directory, then he could still access it.

[bradgrafelman]

Are you sure you gave us the correct URL/filename? The link you posted resulted in a 404 error, not a 403 as expected.

Beyond that, I would check what NogDog said - if you have any script on your site that does a sort of dynamic include (e.g. something similar to include($_GET['page'] . '.php')) then that's most likely the culprit; many programmers make the 'newbie' mistake of forgetting to properly sanitize the incoming parameter before throwing it into a filesystem path.

[jerry_louise]

During the night i moved the file to before the htdocs directory and set up a .htaccess file to make out that the file is forbidden from the /htdocs/includes/ directory.