I have some txt files with informations, but this *.txt files is going to be readable and writable by server php, (for example include them or just check them).
but i dont what this files to be accesstable from browser for example the user must can not
view the files with http:// mysite/myfile.txt
what perrmission i have to set up for this files when php makes them?
You can't do that using permissions. In both cases server will read file.
You have to put this file in public parent directory (eg. in directory where is your public_html). This way you'll be still able to include it but noone can read it using browser.
Second option is to set correct .htaccess file to deny all users (it'll still allow you to read it from scripts), eg. like this:
order deny,allow
deny from all
Related
I have a service where a user is allowed to upload anything they please. I have code execution and others disabled, but I cannot find a way to prevent a .htaccess file they upload from executing.
You should always rename user uploaded files! If you do not do that, user can easily upload hack.php and then launch it to get your site hacked or abused. So this is in fact your problem.
Rename your files after upload. Keep original name (along with i.e. size, mime type etc) in database and route file download/view via the script which would take that original name from DB and build proper headers and then file() content of that file to the user. That would prevent a file from being executable on your server
Or if that's the problem with .htaccess only (but I dare to say it is wider) then you can configure apache to ignore .htaccess in certain directories. It requires root rights on the machine, but you can add <Directory FOLDER> block to host configuration and put AllowOverride None in it.
Or, just check target filename on upload and reject any .htaccess and .htpassword. Or anything with name starting with .
I'm having a bit of trouble trying to access the content of .txt files on a remote server that are in an .htaccess protected directory.
What I am trying to do is the following:
Connect to the FTP server via PHP and use ftp_nlist to retrieve a list of all the .txt files in a directory. Up to here, everything works fine.
For each .txt file found, I want to retrieve the contents. There are a number of ways to do this normally which all work fine when there is no .htaccess file protecting the .txt files.
BUT! As soon as I protect the online directory with the .htaccess file, every single method I have tried fails to get the contents of the .txt files. The .htaccess file that is protecting the folder that contains the .txt files has the following (and nothing else):
<Files *.txt>
Order Deny,Allow
Deny from All
</Files>
Obviously, the online PHP website itself can access the contents of the .txt files without any problems, and the .htaccess file itself is doing it's job perfectly (denying direct access to any of the files), but when I'm trying to access the .txt files remotely from my WAMP server, I just can't find a way to bypass the .htaccess protection.
Basically, I want to imitate remotely, from my WAMP server, what my website already does itself locally by using $contents = file($filepath). Surely there must be a way... Can anyone point me in the right direction? Should I be using a different method of protecting the .txt files, or should I be using a specific PHP function to access the contents?
Your question isn't clear.
If you protect a folder or a file with .htaccess you will be still able to download that file with FTP. .htaccess affects only Apache (http requests).
If you want to be able to download those file anyway with http, then you just do a script that outputs its content:
downloader.php:
//> Check if the admin is logged, and check if $_GET['filename'] is allowed
readfile($_GET['filename']);
Then you can request your file with:
http://yoursite/downloader.php?filename=file.txt
Of course be sure to protect the access of this downloader.php
I'm using php and MYSQL. I've created a members area where people can upload important images (basically for financial record). I was hoping to get some advice as to the best way to store these files. What kind of folder structure would be best? Ex domain.com/Files/UserName/RandomGeneratedName/Files.
Also any advice for chmod, .htaccess, .htpassword and any kind of password protection with php.
Thanks in advance.
I would recommend to store them outside the tree. In this way, by default you need to enable access to them, not disable access (just in case you have a bug in your .htaccess/config/code, the access to the files is disabled, not enabled)
Second, get rid of the random directory, it doesn't add much to the security, but it complicates the implementation unnecessarily
You can use php to check the member credentials, put the appropriate headers (mime type for ex., etag, etc.), and serve the file via passthru or something similar.
Best way:
protect the directory with .htaccess
add an index.html to directory "just in case"
use random file names to store them in your directory
use php/mysql to check if user has access rights to your files
example:
You have a file in domain.com/protecteddir/sdjasdu83299sdnYUsb.dat
You can use php/mysql to send to user to a virtual directory to download the file. You can throw the correct file header + file name via php. So even if the file is called sdjasdu83299sdnYUsb.dat the user would download it as "myfinancial.doc"
The user will never know what the real file is located nor its name.
Your .htaccess file should contain:
<Files *>
Order Allow,Deny
Deny from All
</Files>
you could .htaccess for URL Rewriting and get the index.php file (write this code: ) in folder that save your files, so when anyone want to enter this folder:
First: he dont know real address
second: due there is a index.php that offer to home page he could not enter.
Among many folders available on the server by default like "public_html", "public_ftp" or simply the root, which one is the best to upload and store users' images safely which I can also add a link to mysql db?
If your clients upload images via http form, store it in public_html if they need access it from web.
I recommend you to save the files somewhere in "public_html" and create the following file to restrict public access:
file: upload/.htaccess
deny from all
In your php script you can send the files only to the users with access.
In my opinion, store it outside of the public htdocs folder. This is so that if someone manages to upload anything other than an image file (such as an evil PHP script), they won't be able to call it (and it won't run).
If you're public_html folder is say /path/to/website/public_html I'd store them in /path/to/website/uploaded_images
Also, make sure you that validate it so that it uses a white-list of allowed image names (such as only allowing .jpg, .gif and .png)
Edit:
You also need to create a script which opens the image file and passes it through back to the user
Define safely.
If you want to display these images on a site, that will be a folder in public_html, obviously, unless you want to use a script which presents the images to the user, possibly altering the image on-the fly, changing cache headers etc. Then you may move that folder outside of docroot anywhere the script will have access to those files.
Personally I store user images, files and everything in docroot, protected by .htaccess and accessed via a script which handles user permissions, if necessary. The files reside in an /uploaded folder with subfoldering up to 2 levels deep, each 'level' storing up to 1024 dirs/files. Files are named by their ids only, without any extension, all file info is stored in database. Took me some time to implement, but thankfully this is a reusable code.
Any folder inside your document root is fine. If you want it to be secure, make sure your script accepts only allowed file typed and, as another measure, put an .htaccess file inside that folder:
<FilesMatch "*.php">
SetHandler None
</FilesMatch>
This will ensure nothing get's executed from inside this directory.
Current status.
I have to set
606 for my foobaa.txt.
I wrote a php code,
that read and write
foobaa.txt,
and I want to make the
permission of the foobaa.txt as
600.
But when I tested 600,
the PHP code can not read and write
foobaa.txt.
so I changed to 606 the foobaa.txt,
then my PHP code can read and write
the foobaa.txt.
this is problom, because
when someone put
ttp://blabla.foobaa.com/foobaa.txt
directly, then he can see the contents of the
foobaa.txt.
This is security hole.
so I want to make 600 for the
permission of the foobaa.txt,
but if I do so, then
the php code can not read and write
foobaa.txt.
I think the admin can modify some
apatch settings for we can set the
txt file's permission as 600.
or do I have to do some other things?
like .htaccess or something.
Your PHP code runs as the web server, not the user that is SSH'ing into the account and changing the permissions. So if the text file is readable by the script, it is readable by the server. You will want to control outside users' access to the file by one of a couple of methods.
Put the file outside your DocumentRoot, so that the script can access it, but it's impossible to request by HTTP.
Put the file in a directory with a .htaccess file that reads simply Deny From All. You could also protect the file individually, but it's likely that you'll have other, related files that should be kept private. You can just put those in the same directory.
You could restrict access through .htaccess:
<Files foobaa.txt>
Deny from all
</Files>
or something similar. But this isn't perfect... better would be moving the file outside your public_html (or equivalent) folder.