Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have written a small PHP package/site-template (should I say).

It contains a directory data/ that contains some important files that the users should not be able to see.

These file should however be accessible by my PHP scripts. Now ,the question is how can I prevent users from accessing a particular directory on the web.

Can I do this using .htaccess file? If yes, how?

If in case the user is not using Apache, but some other server like nginx or IIS or any other server for that matter. Is there a portable way to do this?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Yes, you can do this with .htaccess:

Order deny,allow
Deny from all

If you want a portable way to do this, just put the sensitive data outside of your docroot. This is the preferred way to store things like database credentials, temp files/session data, and other things you want to control access to (such as downloadable products if you're selling MP3s or ebooks online).

Edit:

.htaccess is available for nginx, I believe, but it's apparently discouraged.

And, I believe, it's possible to protect the directory using file system permissions if the server is configured to run PHP using suexec. In which case, you ought to be able to set the directory to 400 to allow PHP to read the directory, but not allow direct access by users.

share|improve this answer
    
Hey Lese, thanks. But, as I said that what I have is a package that people will download and copy it to their server. I am not sure if I will be able to create a directory outside the folder where the package is copied. Nevertheless, this package might be copied to a subdirectory of the doc_root. Is there something that can be done with file permissions or something similar? –  Ankit Dec 24 '11 at 22:53
1  
@Ankit: A lot of apps/packages have recommended setups where you set the docroot to a child directory. It's more difficult if you want it installed in a subdirectory, but maybe a symbolic link can solve the problem. See my edit for the rest. –  Lèse majesté Dec 24 '11 at 23:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.