I have installed OpenServer program to modify old company WordPress site locally.
So old WP page was on 5.6 PHP version, and put the same in OpenServer settings.
But program doesn't load page, but always try to download some "download" file. If try to open that file in notepad, it looks like usual index.php (what load WP).
So i played with .htaccess, server see it, but cant load php by some reason.
Same way i created clean WP doimain folder, what works. And just if i change php and apache version it didnt see MySQL DB.
What it may be ? If you need some screens, i can make them.
Problem was in .htaccess file.
By default it was ->
AddHandler application/x-httpd-ea-php56 .php5 .html
I was changed it to ->
AddType application/x-httpd-ea-php56 .php5 .html
Page loads now correctly by browser.
Ran into this while moving some sites from a one server to another:
The .htaccess file only has this in certain directories:
SetHandler application/x-httpd-php
but it does not parse url's like:
domain.com/dir/filenameWithoutExtension/
where 'filenameWithoutExtension' contains the actual content. And should generate the page
The site is hosted on Ubuntu (Directadmin) with:
First PHP: PHP 7 php-fpm
Second PHP: PHP 5.6 suphp
Apache 2.4.33
Does anyone know how to manage this correctly?
I noticed that it's possible to run a file via PHP even if its extension wasn't .php, for example file test.xyz.php.whatever.zyx can be still run with PHP even when the extension isn't .php! It just happens to have .php. in the filename, and that's enough for my Apache to run the PHP script.
I tried (as someone suggested) to put this in a .htaccess file on that folder:
php_flag engine off
But it didn't work on my machine.
The only solutions I know for now are:
Rename to known file extension, which is not run via PHP, such as .txt.
Remove all dots from the filename, thus making it extensionless.
But I'm still not sure how these solutions would work on other servers than my Windows server (with Apache).
Is there any other solutions which doesn't need the filenames to be renamed in any way?
for uploading by users I suggest that you upload a folder in a layer above the root path
in this case Only You Have Access To upload folder( In direct addressing)
and an attacker have not access to any files in this folder
Thus you disable an attacker action to run malicious file
To be completely secure, you'll need to do a couple of things:
Set your upload directory above your "public" folder, making it inaccessible from a browser. This setting is in php.ini (php config file). You'll need to restart Apache for this to take effect. On most Redhat / Fedora / CentOS web servers, this can be:
upload_tmp_dir = "/var/tmp/"
OR, on my local Windows 7 WAMP install, it is set to:
upload_tmp_dir = "c:/wamp/tmp"
Disable scripts from running on that directory (c:/wamp/tmp), in .htaccess:
RemoveHandler .php .phtml .php3
RemoveType .php .phtml .php3
php_flag engine off
In your PHP script, get the uploaded file, filter it based on mimetype (not filetype extension), change the filename, and put it into a secured publicly accessible folder. In more detail:
create a whitelist of filetypes, ex: only images (jpeg, png, gif, bmp). This can be done using mime_content_type() http://php.net/manual/en/function.mime-content-type.php or the newer finfo_file() http://us3.php.net/manual/en/function.finfo-file.php
choose a new filename, often it's best to use a random MD5 hash based on the original filename + salt + timestamp.
move it to a public folder, ex: "c:/wamp/www/project_name/public/uploads"
Preferably use an MVC framework, such as Zend Framework, which includes filetype filtering.
If you do all of that, you should be secure. Obviously you'll never be 100% safe, since there are countless obscure exploits targeting PHP, MySQL, the command line, etc, particularly on older systems. On larger company webservers (what I work on), they disable everything, and selectively enable only what is required for the project. With a system such as WAMP, they enable everything, to ease local development.
Good practice for working on a professional project is to get a cloud server account with Rackspace or Amazon, and learn how to configure php.ini, and httpd.conf settings, as well as PHP security best practices. In general, do not trust the users input, expect it to be corrupt / malicious / malformed, and in the end you'll be secure.
First of all you need to understand what happens here:
test.xyz.php.whatever.zyx
Such a file on a webserver on it's own would do nothing. Only added configuration does tell Apache to execute PHP on that file.
So if you remove that added configuration, Apache won't care to find .php in there - be it at the very end or part of a stacked file-extension.
Check which handler you have set for php in your server configuration. Remove it for the upload directory. This then won't resolve any other configuration issues you might have with uploaded files, however PHP files aren't executed by PHP any longer then - which is what you want if I understood you right.
If you've got a problem to find out what this is about, you need to post your PHP configuration in your httpd.conf file and associated Apache HTTPD configuration files for your system.
The directive somebody told you for .htaccess:
php_flag engine off
does only work if you're running PHP as an apache SAPI module.
Instead of php_flag engine off you could remove the handler for PHP files using an .htaccess file for a single directory.
In the directory you are disabling PHP in, your .htaccess should include:
RemoveHandler .php .phtml .php3 .php4 .php5
RemoveType .php .phtml .php3 .php4 .php5
You can likely get away with the below however, depending on which AddHandler types you have configured in your default Apache configuration, which, on windows, should be in C:\Program Files\Apache<version>\conf\httpd.conf
RemoveHandler .php
RemoveType .php
You will also need to ensure that in your main apache configuration file, that the directory containing the .htaccess file is in, is covered by a Directory statement which has AllowOverride FileInfo set. You may wish to consider AllowOverride All if you will be using .htaccess files for other purposes - see the Apache documentation for AllowOverride for an explanation of the differences.
Personally, this is the main reason I no longer upload files to the web server under any circumstances. Instead, I use S3 / Amazon SDK to move the uploaded temp file directly to a bucket on S3 with Private permissions (I use S3, any other CDN will work just as well). If the file needs to be viewed or viewed by a web client, I use a "getter" function of sorts that integrates with the SDK to get the file and display it.
There are just so many uncontrollable variables that come into play whenever you allow any kind of file upload to a web server, it can be difficult to manage permissions, filtering, and even just space. With S3 (or any other CDN), that is all very easy to manage, and all files are effectively quarantined from the server by default.
On Apache you could disable all dynamic handlers for the directory that contains the untrusted files.
SetHandler default-handler
this is not really good answer but hope useful in some special cases ...
you can use mod_rewrite in .htaccess file like this :
RewriteRule ^(.+).xyz.php.whatever.zyx$ index.php?openfile=$1 [NC,L]
and inside your index.php file :
$file = secure_this_string($_GET['openfile']);
include($file.'.xyz.php.whatever.zyx'); # or some other files
remember to see this answer for security reasons StackOverFlow
and in test.xyz.php.whatever.zyx file :
<?php echo 'hello';
now if client requests /test.xyz.php.whatever.zyx file , out put should be 'hello'
A simple regex would do the job
<?php
$a = strtolower($_FILES["file"]["name"]);
$replace = array(".php", ".phtml", ".php3", ".php4", ".php5");
$_FILES["file"]["name"] = str_replace($replace, "", $a);
?>
This works fine on any server
The following .htaccess-code could work and deny access to files containing "php":
<FilesMatch "php">
Deny from all
</FilesMatch>
I could reproduce your issue quite easily on our server. There is a way to fix this, you need to edit /etc/mime.types and comment out lines
#application/x-httpd-php phtml pht php
#application/x-httpd-php-source phps
#application/x-httpd-php3 php3
#application/x-httpd-php3-preprocessed php3p
#application/x-httpd-php4 php4
#application/x-httpd-php5 php5
These lines cause anything with .php in name to be processed.
Once you comment out the entries in mime.types, mod_php config in /etc/apache2/mods-enabled/php5.conf has this entry which correctly only processes files ENDING with .php
<FilesMatch "\.ph(p3?|tml)$">
SetHandler application/x-httpd-php
</FilesMatch>
What is REALLY SCARY is that this is a default config (Ubuntu 10.04 in our case).
EDIT
On Windows the mime.types file should be in apache_home/conf/mime.types
I would really like my index.html to be able to have a PHP script work on it. I read that you can do this through the htaccess file. I only have access to a subdomain website directory, where I can upload my files through FTP.
The directory did not have a htaccess file, so I created one using notepad: .htaccess and added this to the file:
AddType application/x-httpd-php .html
The problem is, instead of loading the index.html page, it downloads it as a file...would I need to add something extra to the htaccess file? :S
You don't need to name the file index.html to have it served by default. You can change the default document using your with an entry in your .htaccess file like this:
DirectoryIndex index.php
Then when you navigate to http://yoursubdomain.example.com you will be served index.php instead of index.html.
If really do want PHP to interpret your .html documents then the entry you had in your question will work when PHP is running as an Apache module. If your host is running PHP as CGI, you want:
AddHandler application/x-httpd-php .html
If it still doesn't work, then this web page has some more suggestions:
http://www.velvetblues.com/web-development-blog/how-to-parse-html-files-as-php/
The directive you have sets the content-type of files with a .html file extension.
If the server has PHP installed and enabled, that content-type will cause it to be run though the PHP engine and then the output from that sent to the client.
If it doesn't have PHP installed, then the file will just be served up to the client with that content-type. Since browsers don't handle PHP scripts themselves, they will then just save the file.
You need to install and enable PHP as well as setting the content-type.
Presumably your hosting is supporting PHP?
If so, then you need to rename your file from index.html to index.php
I'm sure I'm doing something dumb, but I can't tell what it is.
On my remote host, I have a subdir with a bunch of files.
When I request this directory, I can see a listing of the files within this dir.
However, if request any file suffixed .php, my browser says that the resource is not available. Firefox tells me that it can't find the file I requested.
I guess that this is a permissions issue.
For testing purposes, I have set the permissions as permissively as possible.
What could be causing this?
Resource not available (HTTP 503) depends a lot on your server configuration. If you are using a FastCGI version of PHP, have you started the FastCGI backend? If you are using Apache and mod_php, are there errors in the Apache logs?
What web server are you using? Has it been able to serve PHP files before?
if apache, make sure you have something similar to this in your config:
<IfModule mod_php5.c>
AddType application/x-httpd-php .php
</IfModule>