Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database).

My problem with it is that the content directory where the texts files are stored appears to require being world writeable/readable (i.e. permission 777) for it to work. This means anyone can access the text files with a browser! These text files include the blog/comment poster's IP and email address!

This is not secure or good practice, right?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Are those files in the web root? Or below it? If they are below it you're fine. If not you can always block those files from being viewed in a browser using .htaccess. Just place the .htaccess file in that directory with code similar to this:

<Files *.db>
Order Deny,Allow
Deny from All
</Files>

Change .db to be whatever file extension those files are using. Then whenever someone tries to access them via a browser they will get a 403 forbidden error.

share|improve this answer
    
The files are at example.com/content/... –  authentictech Feb 26 '11 at 16:31
    
I tried the .htaccess file in the content directory (replacing *.db with *.txt) but the files are still accessible. –  authentictech Feb 26 '11 at 16:40
    
If the whole /content/ directory is private, you can remove the <Files *.db> bit and make the whole directory inaccessible. –  Blowski May 1 '11 at 16:41
    
The answer is probably a variation of this using .htaccess. Although I note I said it didn't work as intended at the time I can't test it any more so I am marking this as the answer. In my opinion the method chosen by SimplePHPBlog is obviously not very private if contributors' IP addresses and every post are visible to the world but this doesn't really seem to expose any other security vulnerabilities. –  authentictech Oct 22 '13 at 18:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.