My problem started when I was working with the .htaccess file to a directory trying to get php to run inside of html files. I tried ALOT of combinations of AddTypes and AddHandlers. I took them out and now my php files are being downloaded by the broswer instead of running. There are a few other questions on here that I have studied up and down, but they are not exactly my problem.
I'm fairly lost now, I've tried just about every combination of AddType and AddHandler. I've since decided to use mod_rewrite and just have all my files end in .php but I can't get them to run.
This is what I'm using to test:
<!DOCTYPE html>
<body>
<?php
echo("php working");
?>
</body>
</html>
Am I missing something? Luckily I made all my changes at a separate directory than the root so that the site still runs, but none of the php files in that folder can be viewed in broswer. What can I do? Any help is appreciated.
EDIT:
Just to make it clear, I was originally trying to be able to put php in my html files so I was messing around with handlers and addtypes. My server does have php. If I call a php script from a .html file, it runs. I just can't get a php file like the example I included above to open in brower ANYMORE, it used to open in browser. My fear is that I have messed something up by trying all the different handlers in .htaccess. I have since cleared my .htaccess file in hopes that would at least get me to square one, but it hasn't.
SECOND EDIT:
I went to the root directory and made a php file and it ran just fine so its definitely something I changed in the .htaccess for the particular directory. Is there anyway I can reset that directory?
have you made sure to install php correctly within apache?
if you are using php as a module, you need the following:
LoadModule php5_module "c:/php/php5apache2.dll"
AddType application/x-httpd-php .php
# configure the path to php.ini
PHPIniDir "C:/php"
or as a CGI binary
ScriptAlias /php/ "c:/php/"
AddType application/x-httpd-php .php
# For PHP 4
Action application/x-httpd-php "/php/php.exe"
# For PHP 5
Action application/x-httpd-php "/php/php-cgi.exe"
other things to consider, are the permissions set correctly on the php binaries, is the php.ini present and correct, have you restarted apache since installing php into apache?
lastly, php doesnt run within html files, you would need to set the following as pretty much the last thing in the apache config
AddType application/x-httpd-php .html .htm
Do you see the line like this in your htaccess file?
php_flag engine off
If yes, delete it.
One more thing that may help you understand what happened
The following piece of htaccess would make Php from being executed but rather downloaded as a text file
<VirtualHost *>
ServerName sourcecode.testserver.me
DocumentRoot /var/www/example
AddType text/plain php
</VirtualHost>
One more thing
I'm guessing that this topic was addressed once here-> htaccess downloading file instead of loading
I noticed that it's possible to run a file via PHP even if its extension wasn't .php, for example file test.xyz.php.whatever.zyx can be still run with PHP even when the extension isn't .php! It just happens to have .php. in the filename, and that's enough for my Apache to run the PHP script.
I tried (as someone suggested) to put this in a .htaccess file on that folder:
php_flag engine off
But it didn't work on my machine.
The only solutions I know for now are:
Rename to known file extension, which is not run via PHP, such as .txt.
Remove all dots from the filename, thus making it extensionless.
But I'm still not sure how these solutions would work on other servers than my Windows server (with Apache).
Is there any other solutions which doesn't need the filenames to be renamed in any way?
for uploading by users I suggest that you upload a folder in a layer above the root path
in this case Only You Have Access To upload folder( In direct addressing)
and an attacker have not access to any files in this folder
Thus you disable an attacker action to run malicious file
To be completely secure, you'll need to do a couple of things:
Set your upload directory above your "public" folder, making it inaccessible from a browser. This setting is in php.ini (php config file). You'll need to restart Apache for this to take effect. On most Redhat / Fedora / CentOS web servers, this can be:
upload_tmp_dir = "/var/tmp/"
OR, on my local Windows 7 WAMP install, it is set to:
upload_tmp_dir = "c:/wamp/tmp"
Disable scripts from running on that directory (c:/wamp/tmp), in .htaccess:
RemoveHandler .php .phtml .php3
RemoveType .php .phtml .php3
php_flag engine off
In your PHP script, get the uploaded file, filter it based on mimetype (not filetype extension), change the filename, and put it into a secured publicly accessible folder. In more detail:
create a whitelist of filetypes, ex: only images (jpeg, png, gif, bmp). This can be done using mime_content_type() http://php.net/manual/en/function.mime-content-type.php or the newer finfo_file() http://us3.php.net/manual/en/function.finfo-file.php
choose a new filename, often it's best to use a random MD5 hash based on the original filename + salt + timestamp.
move it to a public folder, ex: "c:/wamp/www/project_name/public/uploads"
Preferably use an MVC framework, such as Zend Framework, which includes filetype filtering.
If you do all of that, you should be secure. Obviously you'll never be 100% safe, since there are countless obscure exploits targeting PHP, MySQL, the command line, etc, particularly on older systems. On larger company webservers (what I work on), they disable everything, and selectively enable only what is required for the project. With a system such as WAMP, they enable everything, to ease local development.
Good practice for working on a professional project is to get a cloud server account with Rackspace or Amazon, and learn how to configure php.ini, and httpd.conf settings, as well as PHP security best practices. In general, do not trust the users input, expect it to be corrupt / malicious / malformed, and in the end you'll be secure.
First of all you need to understand what happens here:
test.xyz.php.whatever.zyx
Such a file on a webserver on it's own would do nothing. Only added configuration does tell Apache to execute PHP on that file.
So if you remove that added configuration, Apache won't care to find .php in there - be it at the very end or part of a stacked file-extension.
Check which handler you have set for php in your server configuration. Remove it for the upload directory. This then won't resolve any other configuration issues you might have with uploaded files, however PHP files aren't executed by PHP any longer then - which is what you want if I understood you right.
If you've got a problem to find out what this is about, you need to post your PHP configuration in your httpd.conf file and associated Apache HTTPD configuration files for your system.
The directive somebody told you for .htaccess:
php_flag engine off
does only work if you're running PHP as an apache SAPI module.
Instead of php_flag engine off you could remove the handler for PHP files using an .htaccess file for a single directory.
In the directory you are disabling PHP in, your .htaccess should include:
RemoveHandler .php .phtml .php3 .php4 .php5
RemoveType .php .phtml .php3 .php4 .php5
You can likely get away with the below however, depending on which AddHandler types you have configured in your default Apache configuration, which, on windows, should be in C:\Program Files\Apache<version>\conf\httpd.conf
RemoveHandler .php
RemoveType .php
You will also need to ensure that in your main apache configuration file, that the directory containing the .htaccess file is in, is covered by a Directory statement which has AllowOverride FileInfo set. You may wish to consider AllowOverride All if you will be using .htaccess files for other purposes - see the Apache documentation for AllowOverride for an explanation of the differences.
Personally, this is the main reason I no longer upload files to the web server under any circumstances. Instead, I use S3 / Amazon SDK to move the uploaded temp file directly to a bucket on S3 with Private permissions (I use S3, any other CDN will work just as well). If the file needs to be viewed or viewed by a web client, I use a "getter" function of sorts that integrates with the SDK to get the file and display it.
There are just so many uncontrollable variables that come into play whenever you allow any kind of file upload to a web server, it can be difficult to manage permissions, filtering, and even just space. With S3 (or any other CDN), that is all very easy to manage, and all files are effectively quarantined from the server by default.
On Apache you could disable all dynamic handlers for the directory that contains the untrusted files.
SetHandler default-handler
this is not really good answer but hope useful in some special cases ...
you can use mod_rewrite in .htaccess file like this :
RewriteRule ^(.+).xyz.php.whatever.zyx$ index.php?openfile=$1 [NC,L]
and inside your index.php file :
$file = secure_this_string($_GET['openfile']);
include($file.'.xyz.php.whatever.zyx'); # or some other files
remember to see this answer for security reasons StackOverFlow
and in test.xyz.php.whatever.zyx file :
<?php echo 'hello';
now if client requests /test.xyz.php.whatever.zyx file , out put should be 'hello'
A simple regex would do the job
<?php
$a = strtolower($_FILES["file"]["name"]);
$replace = array(".php", ".phtml", ".php3", ".php4", ".php5");
$_FILES["file"]["name"] = str_replace($replace, "", $a);
?>
This works fine on any server
The following .htaccess-code could work and deny access to files containing "php":
<FilesMatch "php">
Deny from all
</FilesMatch>
I could reproduce your issue quite easily on our server. There is a way to fix this, you need to edit /etc/mime.types and comment out lines
#application/x-httpd-php phtml pht php
#application/x-httpd-php-source phps
#application/x-httpd-php3 php3
#application/x-httpd-php3-preprocessed php3p
#application/x-httpd-php4 php4
#application/x-httpd-php5 php5
These lines cause anything with .php in name to be processed.
Once you comment out the entries in mime.types, mod_php config in /etc/apache2/mods-enabled/php5.conf has this entry which correctly only processes files ENDING with .php
<FilesMatch "\.ph(p3?|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
What is REALLY SCARY is that this is a default config (Ubuntu 10.04 in our case).
EDIT
On Windows the mime.types file should be in apache_home/conf/mime.types
I have a quick question about changing the file types PHP parses. This website gave this line:
AddType application/x-httpd-php .php
But I'm not clear what file this goes into. Any help would be appreciated - thanks!
That line goes into a file called .htaccess, that changes the Apache server configuration for the folder it is on, and all its subfolders (Unless otherwise specified)
Your server should parse php files with the .php file extension by default though. You could use that to add custom file formats for example.
To parse .mp4 files, like you said in the comments, add to your .htaccess:
AddType application/x-httpd-php .mp4
You need to write that in your .htaccess file.
That makes Apache parse .php files through the PHP interpreter.
You can either add that to your .htaccess or httpd.conf file, depending on what you have access to.
for a certain folder on my local Apache-Server (running with Ubuntu) I'd like that all *php-files will be displayed as if they were plain text-files. I need this since I only want to see the source code of these files and NOT run them.
While searching, I found that most people have the opposite problem :-) and couldn't really find a solution for me.
What would I need to include in the .htacces-file of my folder?
THANKS!
THE ANSWER:
in .htaccess-file type
php_flag engine off
#This will prevent apache from executing *.php-files
AddType text/plain php
#this wil display php-files in browser (if not, browser will want to download file!)
Thanks to Brad!
My Godaddy setup wont allow me to edit the httpd.conf files, and the php_flag command doesn't work due to how they've implemented php for me.
I was able to use this in my .htaccess file:
SetHandler default-handler
AddType text/plain php
I put this in the directory above where my FTP user is allowed to access, which forces all PHP files in that directory, as well as all sub-directories to show php as plain text.
This will work for other file types as well. All you need to do is add another line with whatever extension of file you want to be forced to display in plain text. AddType text/plain cgi for example
Look at your httpd.conf file for the AddType of .php extension, and change it fortext/plain, and php_flag engine to the offvalue just as sait by Sam Bisbee.
But prefer do these change in the httpd.conf, the .htaccess are useless if you have a dedicated server, and lowing your perfs.
But you can also just change the extensions of your PHP scripts...
Two solutions off the top of my head...
Change their file name extensions to .phps. Ex., index.phps.
Change the Content-type for them in the .htaccess file. AddType text/plain .php uses mod_mime to do this. More info at http://httpd.apache.org/docs/2.2/mod/mod_mime.html#addtype
Turn off the the PHP module in apache? (if you won't be needing php execution, of course)
I'm trying to set up my .htaccess file correctly and I'm having an issue.
The only thing my .htaccess file at the moment is:
AddType application/x-httpd-php .php .html .htm
This is included because my server is not parsing php in my html files.
However when this is included in my .htaccess file, when I open a page in my browser, the user is prompted to save or open the file locally.
I believe the answer to my issues is setting up an action to be done (run with php) however I cannot find out the path to my php files.
Any help is appreciated.
You will need to edit the configuration for enabled modules. On a Debian/Ubuntu type system this will be in /etc/apache2/mods-enabled The file you are looking for is php5.conf
So far all you have done is specify that (dot) htm, html or php files should be served -by default- as application/x-httpd-php, and to my knowledge there is not a single web browser that would attempt to interpret such content -- hence the save-as dialog.
Either you could fix your .htaccess file not to be broken (it is broken behaviour to serve html files as application/x-httpd-php), or you could manually output the correct HTTP headers using the PHP header() function.
Unfortunately, everyone seems to love abusing AddType (and then complain e.g. that MultiViews is broken). See this article, please.
This is not supposed to work in all cases. It depends on the AllowOverride directive of the web server.
You shoud specify the AddType in the serveur config file rather than in the htaccess.