How can I protect my included php files from direct access? - php

My script...
index.php
DEFINE('DIR', 'http://www.example.com');
DEFINE('IN_PAGE', TRUE);
INCLUDE DIR . ('/incl/header.php');
INCLUDE DIR . ('/incl/content.php');
INCLUDE DIR . ('/incl/footer.php');
/incl/header.php
if (!defined('IN_PAGE'))
{
header("Status: 403 Forbidden");
exit('<B>403 Forbidden</B>');
}
Visiting index.php
Warning:
include(http://www.example.com/incl/header.php)
[function.include]: failed to open
stream: HTTP request failed! HTTP/1.1
403 Forbidden in
/public_html/incl/index-incl.php
on line 4
Warning: include() [function.include]:
Failed opening
'http://www.example.com/incl/header.php'
for inclusion
(include_path='.:/usr/lib64/php:/usr/lib/php') in
/public_html/incl/index-incl.php
on line 4
It works kinda, if I try accessing the file directly I get "Forbidden" message like I wanted.. But I can't include it in my script.. even though I'm pretty sure I followed phpBB's dev wiki correctly.
I'm pretty damn novice, so your help is greatly appreciated! =]

Go for use of htaccess

The ideal way would be to place your include files outside of the webroot.
This is not always possible so make sure your include files don't 'run' any code by themselves. Adopt an Object Oriented approach where either a file contains runnable code, or it's a class file that doesn't do anything by itself.
Another alternative would be to change the extensions of your include files (to .inc for instance) and deny these from direct access with htaccess.
As a pro-tip: when you're including files always include with an absolute path:
include(dirname(__FILE__) . "/includes/template.inc");
// __FILE__ is the diskpath of the current file
and not:
include("includes/template.inc");
This will save you many headaches.
And as the other guys said, never include files from another webserver (http://), this means you're doing something fundamentally wrong :P

You are trying to include like
INCLUDE ('http://www.example.com/incl/header.php');
basically
Change the dir to
DEFINE('DIR', dirname(__FILE__));
Or something similar so it's not using a domain in the include path which then means the include is done locally.

you tries to include a remote file DEFINE('DIR', 'http://www.example.com'); so your server actually calls the url, gets the error and shows it
use relative path eg. DEFINE('DIR', '/'); instead

Your problem is, include uses the local path of files, not the urls. You need to know what is the root path of your files in your account, like /home/your_account/public_html/

Related

Cannot include php files from root using subdomain

I have recently made an API now for that api i have made a subdomain however it broke my php file includes
include $_SERVER['DOCUMENT_ROOT'].'/core/init.php';
now my subdomain i am using is api.website.com and i need to include something from website.com when i try to include its giving the root of the subdomain,
Summary
When i try to include init.php i get
Warning: include(/home/website/public_html/API/core/init.php): failed to open stream: No such file or directory in /home/website/public_html/api/apex/getusers.php on line 2
When i actually need
Warning: include(/home/website/public_html/core/init.php): failed to open stream: No such file or directory in /home/website/public_html/api/apex/getusers.php on line 2
I apologize for my grammar if need be.
Changing your include path to
include ("../../core/init.php");
will fix your problem. However, this is not a recommended approach.
You should think about using a dependency manager like composer. ( https://getcomposer.org/ ). Then your included files will always be under a directory like
/home/website/public_html/vendor/core
and there will be less of a chance of your application breaking if the files in /home/website/public_html/core change.
This should work.
include("../core/init.php");
Use following code
include_once $_SERVER['DOCUMENT_ROOT'] . '/../core/init.php';
visit https://developer.hyvor.com/php/including-files-in-root-with-subdomain.php to learn more.

php include with wamp

I'm developing a site on my local wamp stack. I have created an alias to view the site so i go to localhost/eee/ to view it. Ideally i would like to go to www.eee.lo but ever since upgrading to win8 I can't get it to work.
So this is the problem, i'm making modules for the website so i don't have to change all the code etc... And i don't want to have to go around changing all the url's when i migrate to the online server so i'm creating a file called _control.php which has this;
$_SITELOC = "localhost/eee/";
And then each time i want to include a file i will go;
include "$_SITELOC/scripts/inc/_header.php";
But this doesn't work and i can't work out why as if i echo it rather than include it and then i take what it prints and put it into the url it goes to the correct file. But it throws errors on the include, it gives two warnins;
Warning: include(localhost/eee/scripts/inc/_header.php) [<a href='function.include'>function.include</a>]: failed to open stream: No such file or directory in C:\Users\Chris\Documents\EEE\Website\Site\index.php on line 3
Warning: include() [<a href='function.include'>function.include</a>]: Failed opening 'localhost/eee/scripts/inc/_header.php' for inclusion (include_path='.;C:\php\pear') in C:\Users\Chris\Documents\EEE\Website\Site\index.php on line 3
I read somewhere that it might be to do with the include path so i tried;
set_include_path(get_include_path() . PATH_SEPARATOR . $_SITELOC."/scripts/inc/");
but this too did not work and now i'm not sure where to go.
Thanks, Chris
localhost/eee/ is your public address that you can use in your web browser. This public address should more appropriately be written as http://localhost/eee/. When you move to web server, you get the public address http://www.eee.lo/.
When including files, you have to use file paths. For example, if you have your www (or httpd, whatever) directry in D:\ on windows, then your include path should start with D:\www\eee\.
So, basically you have to use two variables to keep paths.
$_SITELOC = "http://localhost/eee/"; //For all URLs used in your HTML document.
$_INCPATH = "D:\www\eee\\"; //For all internal file includes.
In practice, you will need both of these, and it is good practice to keep the website address and internal paths out of your main script because when uploaded to remote server, not only your public address changes, but you will also have to deal with absolutely different internal (include) paths.
Your idea is basically good, to define one (root) path of the application and include files based on it, but unfortunately you're not doing it quite right. You have basically two ways of doing that.
One way (which I personally find better) is to include local files in your file system, where you can define the root path, i.e. like
define ('ROOT', 'your/document/root/path');
// and then include the files
include ROOT . '/' . '/scripts/inc/_header.php';
The other way would be to include a web resource, what you're trying to do, but you've forgotten to specify the scheme (protocol) you want to use, i.e.
define ('ROOT', 'http://localhost/eee');
// and then include the files
include ROOT . '/' . '/scripts/inc/_header.php';
For more information, see the examples, provided by the documentation for include
Note: If you want to include the source of a php file, i.e. file with definitions of functions, etc., use the first approach. Including files, using the second approach will only include the output produced by that file.
If you include() a URL, you will (probably) be including the output of the script's execution, when you want to include the script's source. It seems like you actually want to include by local file system path.

PHP is looking for a file in the wrong place

I am an amateur web developer and I am trying to get my site live for the first time. The site is working and all of the files are uploaded but the site is not loading my PHP includes.
Here is the error message:
Warning: include(includes/header.php) [function.include]: failed to open stream: No such file or directory in /home4/myUsername/public_html/index.php on line 3
How can I get PHP to look in public_html/ rather than public_html/index.php?
EDIT: I have tried editing the include path. It doesn't seem to change where php is looking for the file. Additionally my includes work properly in localhost.
I'm going to assume this is your folder structure:
public_html/index.php
public_html/includes/header.php
Generally (not always), $_SERVER['DOCUMENT_ROOT'] will now reflect the path to the base public_html directory (this I'm assuming based on the context of your message). This means you can always point to the root this way. - no matter if you have /index.php or /my/deep/file/structure.php
Try this with your include statement on index.php
<?php
include($_SERVER['DOCUMENT_ROOT'] . '/includes/header.php');
You may need to change the include path in your php.ini file or use set_include_path() to change the include path.
Here is the manual entry for the function call if you'd like to read more about it.
Have you checked already the include file?
in given. include(folder_includes/file_header.php);

Include Path - Relative path

PHP-programmers!
I've got a problem with the Include-function in PHP.
I have a website which contains a left column-bar, and that column contains dynamic content which I get with the Include-function with a relative path, because absolute paths isn't available in the Include-function.
When I navigate to other files in other folders I get the error: include(folder/fileToBeIncluded.php) [function.include]: failed to open stream: No such file or directory in /home/mywebsite/public_html/thissite/folder/subfolder/leftcolumn.php on line 3
How am I going to deal with that? I am totally lost, and I've been searching for Google and StackOverflow for about 10 minutes now.
Thank you!
Absolute paths are can be used with the include statement.
Try:
include $_SERVER['DOCUMENT_ROOT'] . '/folder/fileToBeIncluded.php';
// or
include dirname(__FILE__) . '/../fileToBeIncluded.php'; // relative to the path of the file doing the include
At the very least, you can hardcode the path to be absolutely sure (until you move your site elsewhere):
include '/home/yoursite/public_html/folder/fileToInclude.php';
Please see include documentation.
May I suggest creating a dedicated "includes" folder? Something like:
/home/mywebsite/includes
in php.ini, you'd need to add:
include_path = "/home/mywebsite/includes/"
That way, all calls to include check from /home/mywebsite/includes for the file you need before looking for it relative to the location of the current page being process.

Warning: include(../config/config.php) [function.include]: failed to open stream in PHP

i'm getting following error in my PHP file.
Warning: include(../config/config.php) [function.include]: failed to open stream: No
such file or directory in C:\xampp\htdocs\my-proj\functions\function.php on line 2
let me describe my folder structure
ROOT folder /index.php
functions / function.php
config / config.php
signup / signup.php
now, If i use absolute path, then it is give the same error in signup.php, and if I use relative path then it is giving this error in index.php
any help would be appreciated.
use
include("$_SERVER[DOCUMENT_ROOT]/config/config.php");
The file paths are relative to the invoked script. If your application gets invoked by http requests to index.php, then the include() path needs to be relative to that - even if the include statement itself is located in the functions.php script.
A common workaround is to make all paths absolute in relation to the document root:
include("$_SERVER[DOCUMENT_ROOT]/config/config.php");
// Note: leaving out array keys only valid in double quote string context.
That would work in index.php and functions.php alike.
Use include __DIR__."/../config/config.php"; if you want to include a file relative to the file you're currently executing in. If you're using a version of php older than 5.3.0 (you shouldn't), replace __DIR__ with dirname(__FILE__).
$_SERVER['DOCUMENT_ROOT'] is not set when using commandline and requires that your project is relative to the DOCUMENT_ROOT instead of allowing the user to place it wherever they please. If phpMyAdmin used this variable, you would be forced to accommodate it instead of just placing it wherever you want. That's another thing, it's a variable, so there's a potential security issue too.
If config.php is necessary, I suggest using require instead, otherwise use if (file_exists($file)) {require $file;} so you can avoid warnings when it doesn't exist and get an error when it can't be read (I assume if it exists, it's intended to be used).

Categories