I have registered a wildcard subdomain record for the dir /.../public_html/hosting/accounts/. When a user requests a hosting space, I generate a folder in accounts. My index.php (which is also the 404 ErrorDocument) in accounts uses some basic PHP code to determine the subdomain and the path. Using display the file using include({subdomain}/{requested file}).
Therefore, demo.example.com/file would trigger a 404 and the index.php will display the file at example.com/hosting/accounts/demo/file.
I am, however, concerned that the users would be able to access the files of others via get_file_contents, include, exec and etc.
Is this the correct way to provide hosting on a subdomain? Is there another way to do it?
Any assistance would be appreciated!
Related
I have an SPA that uses AJAX calls to assemble content from multiple PHP files. I can add the following into the main application's config file to be able to redirect users that are not logged in back to the login page as long as they tried going through the portal to look at stuff.
// Verify Login to access this resource
if($_SESSION["loggedIn"] != true) {
echo ('resource denied <script>window.location.href = "https://'.$_SERVER['SERVER_NAME'].'/login.php";</script> ');
exit();
}
The problem comes in that there are tons of views, models, controllers, and third party widgets that can still be accessed directly if you simply tried scanning the site for common file architures.
Is there a way to use something like an htaccess or php.ini file to automatically append this login check to all of the php files in a directory so that I don't have to paste this into each and every page?
Baring that, is there a way to set my chmod settings to only allow indirect access to those files such that php scripts running on the server can use them, but they can not be directly visited? Thanks.
[EDIT]
Moving files outside of my public folder did not work because it broke the AJAX.
I also tried auto_prepend_file in an htaccess file, but this resulted in a 500 error. I am using a VPS that apparently won't let me do an AllowOverride All in my Apache pre_virtualhost_global.conf; otherwise, I think that would have been the right way to do this.
Setting the CHMOD settings of my resource folders to 0750 appear to be allowing the AJAX commands to execute without allowing direct access to the files. If anyone knows of any other security caveats to be aware of when doing this let me know. Thanks.
I have been reading about where to securely save a PHP file that has my mysql database connection password. I understand from the forums that it should be saved in a folder above the webroot. I have a cloud server from a hosting company.I have access to root
The path to the public files is as follows:-
/var/www/vhosts/mydomain.co.uk/httpdocs/afile.php
Say I have a PHP file (containing my password) called sqlpassfile.php
Would the following be okay as a place to securely store it? ie in a new folder called Newfolder after vhosts??
/var/www/vhosts/NEWFOLDER/sqlpassfile.php
Sorry for a simple question but just want to make sure its secure
Thanks
All the nowadays PHP framework you will find do, indeed store their whole code base in a level under the web root.
They do not only store informations like credentials actually, they do store all the business logic of the application outside of the web root. They will then only allow a facade file to be accessed (most of the time a index.php or app.php) that will, then, with the help of controllers, handle every request and route you to the right page/content, and, of course, all the static content the site will use (your design images, your css, your js, ...).
For example :
Zend Framework does use a public folder where you will find an index.php and all the static files
Symfony does use a web folder where you will find two files app.php and app_dev.php and again all of the static files
So in your case you could do
/var/www/vhosts/example.com/httpdocs/ is the web root of your server
/var/www/vhosts/example.com/app/ store all the php code you need
/var/www/vhosts/example.com/app/config store all your configuration file, and then maybe your credentials files which you can call sql_config.php
/var/www/vhosts/example.com/httpdocs/afile.php will require_once '../app/config/sql_config.php
Usually, People just save the database connection information in a regular PHP file, for example, Wordpress saves the connection info in it's wp-config.php. Simply because nobody is able to see your password by visiting that php page, nothing is returned.
To make it more secure, you can disable access to php file while mod_php stopped working. Try this in you .htaccess
<IfModule !mod_php5.c>
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
</IfModule>
Please also have a look at this post:
Password in file .php
Whether your method is safe depends on the configuration of the server, something that providers are not often very good at documenting.
Your first line of defence is keeping what is essentially confutation data inside a file named with a .php extension. So if it is accessible from a browser the webserver will execute the file rather than returning the data. You certainly want at least 2 levels of security on your data (each of which you have tested independently).
Considering the path you have chosen, /var/www/vhosts/NEWFOLDER/sqlpassfile.php what happens if you request http://NEWFOLDER/sqlpassfile.php from the server? (In most cases, nothing but once in while....) Generally its better practice to keep it well clear of the directories your webserver uses.
I have a webserver with Apache.
For security reasons my customer wants to access files (.jpg/.pdf/.png/.gif) in another folder.
The root layout is as follows:
backup
data
etc
htdocs
logs
tmp
In the htdocs folder the Joomla website resides. I use flexicode to add PHP code to the site.
Is there a way I can show for example a photo in .jpg from the data folder?
example. /data/werknemers/80111/pasfoto.jpg
There is a little snag. Everybody uses a pin number to log into Joomla. In this case pin 80111.
Pin 80111 is added to the users table, the field is called pin.
Is it possible to use a variable to retrieve the data? So only user 80111 can access his or her folder and not another one?
The photo is shown in a module on the website after login.
Cheers,
Steve
You'll have to write a php script in joomla (for the authorisation), and give apache access to the external folder. Then deliver your files using this script.
I'm not a Joomla user, but my first chance will be to look for some plugin to manage the uploads, I saw some plugins to manage uploads per user doing a quick google search, for example this one.
In the case that no one works for you I think the next option will be try to implement an asset proxy.
Write an script in htdocs to validate the PIN and if it is ok read the file content from the data directory and provide the output from that script.
An rewrite rule to redirect all .jpg/.pdf/.png/.gif request for that proxy will be need.
Be aware to serve the non secure content (theme images for example) as well.
Hope this help
Good day all,
I have a folder called documents in my site root, this is password protected by a .htpasswd file, but it is allowed to be accessed by a script to view.
how would I allow a script to be able to download the file without accessing it directly from the directory?
I'll give an example to explain the situation.
on my home page I display the picture test.jpg, this image is in the documents folder that is protected. The image displays correctly on the home page.
If type in the address bar www.domain.com/documents/test.jpg it does not display or downloads, but asks for a password.(this I want, but don’t want people to type in a password for each file they want to download)
Is there a way that I can make php or JavaScript download the document without ever having to prompt for a password? Other words bypass the .htaccess rule?
thanx in advance
I've retagged adding PHP and Javascript. There is nothing stopping you writing a remapper PHP script which is outside the documents folder and therefore accessible without Apache authentication. This could issue a readfile() to send the file (see the document example and user contributions for a more detailed explanation. Since this is a server-side script, it will have direct access to the protected directory.
Of course you might want to implement some form of access control, say appending a request parameter check which is based on the md5 of the filename plus a shared secret. This would be easy to compute in the calling script. However, once you move such access negotiation to a client-side script you need to accept that this could be retro-engineered and exploited by any experienced hacker.
As a footnote, if you want to allow users to download your images, why are locating them in an access controlled directory. Why not just move them out of this directory?
As Barry said, the .htaccess is processed before any PHP is, so bypassing it is not an option. You will have to either change the .htaccess configuration or write a remapper PHP script.
I suggest changing the .htaccess configuration to allow direct download links but deny directory listing. This will allow people to download direct links such as http://www.example.com/documents/some-file-name.ext without being prompted for a password, but they will have to know the link ahead of time - they won't be able to view the /documents/ folder to see everything in there.
You can do this by commenting out or removing the Auth directives:
#AuthUserFile /path/to/.htpassword
#AuthName "Name"
#AuthType Basic
#Require Valid-User
And adding a directive to block directory listing:
Options -Indexes
I own a website which gives every registered user a dedicated space like this:
www.mywebpage.com/user1
www.mywebpage.com/user2
www.mywebpage.com/user3
Inside this path the user has his mini web site.
I'd like to give my users not a path within my domain, but a second level domain like this:
user1.mywebpage.com
user2.mywebpage.com
user3.mywebpage.com
A lot of websites do this, but I can't figure out how to get it!
Am I supposed to register a CNAME in my dns record for every single user? How the hell can I achieve this with PHP? I don't think it's possible to configure godaddy with a human-hand written script.
I may register an alias CNAME which points every second level domain to my top domain, and then check within my top domain the first token of the url retrieving the user: but now I can't redirect him on a new page (which is the index of his subsite) or I'd lost the web url userx.mywebpage.com.
How can I handle this? I'd appreciate any hint about the right path to follow in order to achieve my goal.
Create a wildcard A record (*.mywebpage.com) pointing to the IP of your server.
Create an Apache virtual host for ServerName *.mywebpage.com, pointing all requests to the same document root. Your script looks at the hostname to know which user's site it is. You do not need to redirect outside of the user's subdomain. If your script sees the subdomain is "www", that's your special case where you display the main website instead of the user's stuff.
The feature you want to see is often called Wildcard sudomain (usually blog sites have this feature).
Usually you make a CNAME record of * to represent the wildcard subdomain. Instead, with Godaddy make an A record with the name * and set the IP to your server. We have done with our ASP.net website in the past (not sure if works with GoDaddy still but give a try).
With a very little knowledge on PHP I can suggest adding some redirection(URL Rewrite) configuration in your httpd.conf or apache.conf file.
Please check this
http://kbeezie.com/view/wildcard-subdomains-php/
after this you can write your own logic. All you need to do is find out your user from db which is in the subdomain name and render the pages.
You don´t have to set up dns entries for what you´re trying to achive. Depending on how much control you have over your website, in case you´re using Apache you can easily set up virtual hosts for your subdomains (see http://content.websitegear.com/article/subdomain_setup.htm)