Preventing PHP from executing in dir's

Anon

Hi,

Just wondering if anyone can help me with a problem to do with safe_mode, open_basedir, and doc_root.

I have read through lots of the manuals and stuff and have tried lots of different combinations of config settings but have not been able to work this one out. I have also seen posts here about the same sort of question but again they have not helped me very much.

What i have is a single website located at /website/apache/htdocs

i also have a dir at
/website/apache/htdocs/php

What i want is any .php file in the /php dir to execute as normal and be served. For example if i had a file - phpinfo.php - with <? phpinfo() ?> in it, and i went to that dir on the server using a web browser and opened phpinfo.php i would get a dump of all the php information. but i want it so that if i put that same file in any other dir, other than /php(and subdir's)/, it would just eaither denie access to that file, or just spit out the source (just anything other than execute the php code inside).

Some of the things i have tried is to turn safe_mode on and put open_basedir = /website/apache/htdocs/php
but that does not seem to help and the other thing i have tried is to do the same with a doc_root = /website/apache/htdocs/php
and again, that did not seem to help at all.

I have been making these changes in the php.ini file that is listed when i do phpinfo(), and have been restarting the apache server after i have made the changes.

PHP is not compiled as a module, but is compiled into the apache httpd.
I have the latest stable release of both of them, at time of writing.

Any help would be great.

Thanks

-|- Hurgh -|-

Anon

Not totally sure, but I think you have to setup something in Apache's httpd.conf

Anon

hmmm, i looked at stuff like that also, but could not see ne thing that was relevant, from what i read on the manual pages here, you only need to do stuff in the http.conf if you installed php as an apache module, and i did not do that, i have compiled it into the apache httpd server binary

Ne one else have ne ideas??

-|- Hurgh -|-

Anon

It's all in httpd.conf you need to set up directory options

Mark

Anon

Mark,

Thanks for the reply, from what i read in the manual, i thought i did not need to use the http.conf file for php related stuff, but assuming that i do, how would i go about setting up these dir options that you are talking about?

Can you give me an example piece of code so that i can try it out??

or a link to the info that i need to know.

Thanks

-|- Hurgh -|-

Anon

Ive not experimented with httpd.conf but directory commands usually come in this form

<Files ~ ".inc$">
Order allow, deny
Deny from all
</Files>

It's not a solution but it's somewhere along these lines check httpd.conf

Mark

hurgh

Thanks all for your help,
Mark you were correct the stuff that i needed to change was in the http.conf file.

This is what i did just incase there is anyone else out there that has the same problem and can not find the solution. This may not be the best way or the correct way to do this, but it worked for me and did all that i needed it to do so this is what i did:

First off in the http.conf file (in the config dir of your apache webserver) i found the lines that looked like this:

AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

and i put a # in front of them, which makes them a comment so that means that they do not get excuted/looked at while the config file is being parased.

NOTE: comment out all the lines that have something to do with PHP - we will be adding them somewhere else later.

I then added this little snippet to the http.conf file:

<Directory "/website/apache/htdocs/php">
AllowOverride All
</Directory>

NOTE: Change the "/website/apache/htdocs/php" to the dir that you want PHP to work in.

What this does is makes that php dir able to have the .htaccess file overide settings in the main config file. This will allow us to specify the AddType's that we removed above, just for that php dir. Just incase you are wondering to add that bit of code, i added mine just under the one that looks like:

which is where it sets the document root (it should have a comment above it, and your path will probably look different).

Ok, now that is all done there is just one last thing that needs doing before we restart the webserver.

If you go to the directory that you typed in as your php directory, and create a file called .htaccess - if the file already exists just add the lines needed below.
In this file all we need to do is add 2 lines (it could be more if you want, for example if you have both php3 and php4 installed, or there might be other things already in the file). Here we add the lines that we commented out above:

AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

If there was more that you commented out then add them also, for example you might have:

AddType application/x-httpd-php .php4
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps
AddType application/x-httpd-php3 .php3

or something like that, but whatever the case, add the ones that you commented out.

Now all that is left is to restart the webserver. Once you have done that, you should be able to only run php files from the php dir (and sub dir's), if there is a php file in any other dir, it will just be displayed as plain text (as in the user will see all the sourece code).

Hope that helps someone out.

If there is any other trouble that people have, please just email me at hurgh@oxley.vic.edu.au

Thanks again Mark for your help also.

-|- Hurgh -|-