2

I have this folder path: pulic_html/user/269851516/in the folder /user/ i have many subfolders that is created when the user create a account, and they can upload avatars to this folder, i want to disable the execution of scripts in this folder, so i created a .htaccess and put in public_html/user/:

<Files *>
    SetHandler none
    SetHandler default-handler

    Options -ExecCGI
    php_flag engine off
    RemoveHandler .cgi .php .php3 .php4 .php5 .phtml .pl .py .pyc .pyo
</Files>

with this code inside my .htaccess nobody can execute scripts in this folder (i gues...). I have searched about it a bit, and i found different ways to do it, so i don't know if i did it correctly, and if there's something missing.

1

with this code inside my .htaccess nobody can execute scripts in this folder (i gues...).

The only way to know whether it works "on your server" is to test it. If it works on your server to block direct script access (from the client) for the type of scripts that you are trying to block then "it works".

With the many different servers, there isn't necessarily a single/best way to do this. The directives you posted are arguably "generic" - designed to work across several different servers. You don't need all of them.

SetHandler none, SetHandler default-handler and RemoveHandler all do the same sort of thing so I can't imagine they are all required. It's likely that different server configs require different settings.

php_flag engine off will only work when PHP is installed as an Apache module. It won't work if PHP is running as CGI/FastCGI - in fact, you may even get a 500 internal server error!

The only change I would perhaps make is to change Options -ExecCGI to the more encompassing Options None. This also disables Includes (server-sides includes), Indexes (directory listings) etc. But it's possible these are already disabled in your server config.

The <Files> wrapper may be required on some servers if using the SetHandler/RemoveHandler method to block running scripts. Whilst <Files *> simply targets every file, as if there is no wrapper at all, it changes the order of execution so the directives run later - to ensure they override any earlier AddHandler directives.


UPDATED:

However, to clarify... this doesn't necessarily "disable the execution of scripts in a folder". It prevents the client (user-agent / browser) from making direct (HTTP) requests to scripts in a directory. Any script can still be executed in this directory if it is "called" (eg. included) from another script elsewhere on your system.

For example, say you have protected the /public_html/user directory tree with a .htaccess file at /public_html/user/.htaccess and you have another PHP script elsewhere on your filesystem, say at /public_html/foo/bar.php and bar.php has a statement like:

include($_SERVER['DOCUMENT_ROOT'].`/user/myavatar.jpg`);

Then myavatar.jpg will still be "executed", despite /user/.htaccess disabling script access to this directory. (In this contrived example, myavatar.jpg is not a JPG image, but a PHP script containing <?php blocks - the file extension is irrelevant). The .htaccess file is only processed for direct HTTP access, not filesystem access from other scripts.

See also this related question:

  • you said: this doesn't necessarily "disable the execution of scripts in a folder". Are you talking about this? <FILES> and <Directory> from this link: webmasters.stackexchange.com/a/74669/93636 what is the difference? I put my .htaccess in public_html/user/ and any .php file that is on the subfolders inside /user/ is not being executed. So i don't know what are you tring to say – Natalie Jan 18 at 2:52
  • 1
    No, nothing to do with <Files> and <Directory> containers. The linked question is about using the main server config, not .htaccess. In the main server config, you need to use <Directory> containers instead of .htaccess files to target a particular directory tree. <Directory> is not permitted in .htaccess. I've updated my answer with an example explaining what I mean. – MrWhite Jan 18 at 11:02
  • there's is another way to call this file without direct HTTP access and PHP? I mean, could someone call (include) this file using the devTool? I can retrive the data from a file using Ajax call, but i don't if it's possible to do a non HTTP reques on the devTool – Natalie Jan 18 at 19:34
  • 1
    What's "the devTool"? (Chrome's DevTools? - No, that's just an HTTP request.) I was just stating how the script could potentially be run within that directory (that is otherwise "secured" by .htaccess) - whether that is actually possible or not on your system is another matter entirely. (There would need to be other potential vulnerabilities on your site for that to happen - site hacked, rogue plugin, bad coding, .... etc.) – MrWhite Jan 19 at 0:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.