2

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database).

My problem with it is that the content directory where the texts files are stored appears to require being world writeable/readable (i.e. permission 777) for it to work. This means anyone can access the text files with a browser! These text files include the blog/comment poster's IP and email address!

This is not secure or good practice, right?

1

Are those files in the web root? Or below it? If they are below it you're fine. If not you can always block those files from being viewed in a browser using .htaccess. Just place the .htaccess file in that directory with code similar to this:

<Files *.db>
Order Deny,Allow
Deny from All
</Files>

Change .db to be whatever file extension those files are using. Then whenever someone tries to access them via a browser they will get a 403 forbidden error.

  • The files are at example.com/content/... – authentictech Feb 26 '11 at 16:31
  • I tried the .htaccess file in the content directory (replacing *.db with *.txt) but the files are still accessible. – authentictech Feb 26 '11 at 16:40
  • If the whole /content/ directory is private, you can remove the <Files *.db> bit and make the whole directory inaccessible. – Dan Blows May 1 '11 at 16:41
  • The answer is probably a variation of this using .htaccess. Although I note I said it didn't work as intended at the time I can't test it any more so I am marking this as the answer. In my opinion the method chosen by SimplePHPBlog is obviously not very private if contributors' IP addresses and every post are visible to the world but this doesn't really seem to expose any other security vulnerabilities. – authentictech Oct 22 '13 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.