Restrict PHP use for certain folder

[Anon]

On my server there are folders which I don't want people to be able to write and use php files. I want to restrict them to only http. Is there any way I can selectively turn off the ability to create php code in certain directories so that users can't try to hack around my system.

Thanks
Robert

[Anon]

Simple answer - don't give end users write access to the web root of your server.

If they want changes on your web site, they'll have to go through you.

If they want to upload stuff, give them ftp access to a specific directory and then check out the material first , before moving it across to the web root.

There's probably a much better technical solution to this, but this is the quick and dirty answer.

Oh, btw - you never mentioned what platform or web server you were running.

[yelvington]

Yes, there are a couple of ways to tackle this with Apache.

One way is to put the following in your httpd.conf file. If you are running a virtual server, this can go inside the virtual server portion of your configuration.

<Location /foo>
AddType application/x-httpd-php-source .php .php4 .php3 .phtml
</Location>

Now for anything under the /foo URI that carries any of the common PHP suffixes, you're going to get nifty colorized code instead of running the PHP scripts.

You also could use the <LocationMatch> directive, which uses a regular expression.

And you could just AddType text/plain for those file types if you prefer.

[carlosa69]

what if you want people to be able to upload scripts. but you dont want them to be able to for example delet your httpd (appache) folder? is there a way to restrict the access and or privleges of scripts?
-carlos aguilar