How to disable arbitrary PHP 7 code in directory? - php

Question at the bottom.
According to the official Mediawiki security guide, I have to
<Directory "/Library/MediaWiki/web/images">
# Ignore .htaccess files
AllowOverride None
# Serve HTML as plaintext, don't execute SHTML
AddType text/plain .html .htm .shtml .phtml .php .php3 .php4 .php5 .php7
# Don't run arbitrary PHP code.
php_admin_flag engine off
# If you've other scripting languages, disable them too.
</Directory>
However with Apache 2.4.29 and PHP 7.1.15 I get
Invalid command 'php_admin_flag', perhaps misspelled or defined by a module not included in the server configuration
According to this post the solution is
You cannot use php_admin_value/php_admin_flag with PHP compiled as CGI
(suPHP), because these options are only supported when PHP is compiled
as a module of Apache. Feel free to use php.ini sections to change the
settings (http://php.net/manual/en/ini.sections.php). Otherwise - just
switch to mod_ruid2+mod_php and you'll be able to use php_admin_value
in Apache configuration files.
Even when I have installed
dnf -y install httpd php php-mysqlnd php-gd php-xml php-mbstring mod_ruid2
I get the error, despite having mod_php and mod_ruid2.
Question
Can someone translate the above into what I actually need to do in my case in plain English?

For a single directory:
<Directory "/Library/MediaWiki/web/images">
php_admin_value engine Off
</Directory>
For multiple directories under the same path:
<DirectoryMatch ^/Library/MediaWiki/web/(images|other_folder|other_folder)>
php_admin_value engine Off
</DirectoryMatch>
There's also <LocationMatch "path"> - more directives here:
http://httpd.apache.org/docs/current/mod/core.html#locationmatch

Related

ubuntu 20.04 apache2 - php files downloading

php files do not load in the browser, but are downloaded. I have read through many solutions to this problem on both serverfault.com and stackoverflow. (Many of the posts are several years old with older versions of Apache and php, and some of the config files and their locations have changed.) I've found a common set of solutions to the problem, but none of them have worked for me. The following links contain examples of the suggestions I have tried that didn't solve my problem.
apache2 on ubuntu - php files downloading
Apache shows PHP code instead of executing it
https://serverfault.com/questions/25227/why-is-php-script-downloaded-instead-of-executed
https://serverfault.com/questions/286882/apache-is-not-interpreting-php-files
I installed apache2. If I go to "localhost" in my browser, it serves up the "Apache2 Ubuntu Default Page". I installed php. "php7.4.conf" and "php7.4.load" appears in both /etc/apache2/mods-available and /etc/apache2/mods-enabled. I verify that php is enabled with sudo a2enmod php7.4, which gives
Considering conflict mpm_event for mpm_prefork:
Considering conflict mpm_worker for mpm_prefork:
Module mpm_prefork already enabled
Considering conflict php5 for php7.4:
Module php7.4 already enabled
Based off multiple replies in different questions, I have ended up with the following in my /etc/apache2/apache2.conf file (note this is not the entire file):
Include /etc/phpmyadmin/apache.conf
AddType application/x-httpd-php .php
# Use for PHP 7.x:
LoadModule php7_module modules/libphp7.4.so
AddHandler php7-script php
AddType application/x-httpd-php-source .phps
AddHandler application/x-httpd-php .phps
AddHandler application/x-httpd-php .php
AddType application/x-httpd-php .php
# Add index.php to your DirectoryIndex line:
DirectoryIndex index.html index.php
Notes: I have verified that the apache2.conf file is being executed, by adding a bad line to the file and attempting to restart apache, which resulted in an error. libphp7.4.so is located in /usr/lib/apache2/modules.
And my /etc/apache2/mods-available/php7.4.conf and /etc/apache2/mods-enabled/php7.4.conf files look like this:
<FilesMatch ".+\.ph(ar|p|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch ".+\.phps$">
SetHandler application/x-httpd-php-source
# # Deny access to raw php sources by default
# # To re-enable it's recommended to enable access to the files
# # only in specific virtual host or directory
# Require all denied
</FilesMatch>
# Deny access to files without filename (e.g. '.php')
<FilesMatch "^\.ph(ar|p|ps|tml)$">
# Require all denied
</FilesMatch>
# Running PHP scripts in user directories is disabled by default
#
# To re-enable PHP in user directories comment the following lines
# (from <IfModule ...> to </IfModule>.) Do NOT set it to On as it
# prevents .htaccess files from disabling it.
# <IfModule mod_userdir.c>
# <Directory /home/*/public_html>
# php_admin_flag engine Off
# </Directory>
# </IfModule>
After every change I have made, I have restarted apache with sudo service apache2 restart. I do a test and still php files are downloaded. I'm using a simple php file called verify.php, which contains the following:
<?php
phpinfo();
?>
I've never worked with these things before so I could be missing something obvious? For some additional context, I'm working on a school project where I plan to use a php page to query a database and generate a table with the results.
In my case of similar hardship:
I do not need those statements in apache2.conf:List item
I have similar content in my /etc/apache2/mods-available/php7.4.conf and /etc/apache2/mods-enabled/php7.4.conf
I ran:
sudo a2dismod mpm_event && sudo a2enmod mpm_prefork && sudo a2enmod php7.4
However what got me to work is a misspelled 'php' as 'phd' (in SetHandler application/x-httpd-php of etc/apache2.conf):
<FilesMatch \.php$>
SetHandler application/x-httpd-php
</FilesMatch>
I think that is the only needed command to call PHP as handler.
p.s. I have more than one instance of messed up config files.. i haven't found a good control template for all those linux configuration process. (this time the install was started by somebody, i took over the second part)
(This section contains notes and hints specific to Apache 2.x installs of PHP on Unix systems.
https://www.php.net/manual/en/install.unix.apache2.php)

How to use PHP7 code in HTML file with the help of .htaccess setting

I am using linux server and in my server I have install PHP 7.* version. I want to use PHP code in HTML file. Right now it render PHP code in in web page. I am using the following code in my .htaccess file but it not working.
AddHandler x-httpd-php .html .htm
and
AddHandler php7-script .php .html .htm
and
<FilesMatch "\.html?$">
SetHandler application/x-httpd-php7
</FilesMatch>
But all are these not working.
After you installed php7.0-cgi
sudo apt install php7.0-cgi
you can add to your .htaccess
AddHandler php70-cgi .php
tells Apache to run PHP on any file with the extension ".php"
using the Module called php70-cgi that is afaik modules/php70-cgi.so
A reason why its not working could be the webserver settings in
/etc/apache2/sites-available/default
if there is AllowOverride „None“ set it to „All“ else you can only make setting in <Directory> and not in .htaccess
<Directory /var/www/>
...
AllowOverride All
...
</Directory>

How install and configure manually php and apache?

Installed PHP like this:
wget http://in1.php.net/distributions/php-5.3.28.tar.bz2
tar -xvf php-5.3.28.tar.bz2
cd php-5.3.28
./configure
make
make install
Installed Apache2 like this:
sudo apt-get install apache2
So, how do I now link Apache to PHP?
PS - I know I can install PHP as a module which will be 100x easier, but I want to know how to link exactly these two in this way.
Thanks.
Edit your httpd.conf to load the PHP module. The path on the right hand side of the LoadModule statement must point to the path of the PHP module on your system. The make install from above may have already added this for you, but be sure to check.
LoadModule php5_module modules/libphp5.so
Tell Apache to parse certain extensions as PHP. For example, let's have Apache parse .php files as PHP. Instead of only using the Apache AddType directive, we want to avoid potentially dangerous uploads and created files such as exploit.php.jpg from being executed as PHP. Using this example, you could have any extension(s) parse as PHP by simply adding them. We'll add .php to demonstrate.
<FilesMatch \.php$>
SetHandler application/x-httpd-php
</FilesMatch>
Or, if we wanted to allow .php, .php2, .php3, .php4, .php5, .php6, and .phtml files to be executed as PHP, but nothing else, we'd use this:
<FilesMatch "\.ph(p[2-6]?|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
And to allow .phps files to be handled by the php source filter, and displayed as syntax-highlighted source code, use this:
<FilesMatch "\.phps$">
SetHandler application/x-httpd-php-source
</FilesMatch>
And restart Apache
service httpd restart
You can read how do that in the php documentation
http://php.net/manual/en/install.unix.apache2.php
http://php.net/manual/en/install.unix.apache2.php#92797

How to update PCRE in CENTOS/Redhat 6

For installing Scribunto, a Mediawiki add ins, it requires at least PCRE version 8.1. But in CENTOS update, the maximum version is 7.8.
I compiled the source code version 8.33 successfully and with "pcretest -C" command, it is already version 8.33. But the phpinfo() has still the old PCRE 7.8.
How to point PCRE in php to the newest version?
Sigh.
I feel ya.
I can tell you that what finally worked for me was building PCRE from source and using FastCGI (the mod_fcgid package in CentOS 6) with a stanza like this in /etc/httpd/conf.d/php.conf:
<IfModule fcgid_module>
SetEnv LD_PRELOAD /usr/local/lib/libpcre.so.1
ScriptAlias /fcgi-bin/ /var/www/fcgi-bin/
AddType application/x-httpd-fastphp .php
Action application/x-httpd-fastphp /fcgi-bin/php-cgi
<Directory /var/www/fcgi-bin/>
# Allows /usr/bin/php-cgi to be symlinked here
Options +FollowSymLinks
</Directory>
</IfModule>
Here are a list of things I tried with the default "modular" PHP setup (php5_module) before giving up and resorting to FastCGI.
PassEnv LD_PRELOAD with LD_PRELOAD=/usr/local/lib/libpcre.so.1 defined in /etc/sysconfig/httpd.
SetEnv LD_PRELOAD /usr/local/lib/libpcre.so.1
LoadFile /usr/local/lib/libpcre.so.1
However, I was putting these directives inside VirtualHost sections, generally, so I won't rule out the possibility that order was the problem. That is, it's entirely possible that these directives would need to come before the PHP module was loaded, and I wasn't doing that. I was using an /etc/httpd/conf.d/php.conf and a vhosts.conf and generally trying not to sully the top-level config file while I was experimenting.
Eventually I ran out of patience and tried going the FCGI route, and that worked for me. If you're married to running PHP as a loadable module, then you may wish to try some of the above options with things like LoadFile specified in httpd.conf before the PHP DSO is loaded.

Why are my PHP files showing as plain text? [duplicate]

This question already has answers here:
PHP code is not being executed, but the code shows in the browser source code
(35 answers)
Closed 7 years ago.
I've been writing PHP applications using PHP for a while in WAMP. Now I'm installing PHP and Apache HTTP Server separately on my work PC. I've installed PHP 5, and the latest Apache. I go to localhost and see it works!
Now I add a file called test.php which displays:
<?php
phpinfo();
?>
But in the browser it just displays plain text. Is there somewhere I have explicitly tell it to use PHP 5?
You should install the PHP 5 library for Apache.
For Debian and Ubuntu:
apt-get install libapache2-mod-php5
And restart the Apache:
service apache2 restart
You'll need to add this to your server configuration:
AddType application/x-httpd-php .php
That is assuming you have installed PHP properly, which may not be the case since it doesn't work where it normally would immediately after installing.
It is entirely possible that you'll also have to add the php .so/.dll file to your Apache configuration using a LoadModule directive (usually in httpd.conf).
Yet another reason (not for this case, but maybe it'll save some nerves for someone) is that in PHP 5.5 short open tags <? phpinfo(); ?> are disabled by default.
So the PHP interpreter would process code within short tags as plain text. In previous versions PHP this feature was enable by default. So the new behaviour can be a little bit mysterious.
You need to configure Apache (the webserver) to process PHP scripts as PHP. Check Apache's configuration. You need to load the module (the path may differ on your system):
LoadModule php5_module "c:/php/php5apache.dll"
And you also need to tell Apache what to process with PHP:
AddType application/x-httpd-php .php
See the documentation for more details.
You might also, like me, have installed php-cgi prior to installing Apache and when doing so it doesn't set up Apache properly to run PHP, removing PHP entirely and reinstalling seemed to fix my problem.
You will need to add handlers in Apache to handle php code.
Edit by command sudo vi /etc/httpd/conf/httpd.conf
Add these two handlers
AddType application/x-httpd-php .php
AddType application/x-httpd-php .php3
at position specified below
<IfModule mime_module>
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
--Add Here--
</IfModule>
for more details on AddType handlers
http://httpd.apache.org/docs/2.2/mod/mod_mime.html
Are you using the userdir mod?
In that case the thing is that PHP5 seems to be disabling running scripts from that location by default and you have to comment out the following lines:
<IfModule mod_userdir.c>
<Directory /home/*/public_html>
php_admin_flag engine Off
</Directory>
</IfModule>
in /etc/apache2/mods-enabled/php5.conf (on a ubuntu system)

Categories