Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #9787

Re: php includes in readable directory

Show all headers | View raw

In article <kp1uur$8nj$1@dont-email.me>,
 Jerry Stuckle <jstucklex@attglobal.net> wrote:

> On 6/9/2013 5:39 AM, John Anderson wrote:
> > Hello,
> > I've got a website where the apache directory is available to other
> > users with shell accounts: /var/www/html.
> >
> > If I put something like 'db_login.php' in there with a MySQL password in
> > it, and include it from index.php, then anyone with shell access will be
> > able to read it.
> >
> > So I move it out, but where?  Is there a 'standard' place to put stuff
> > like this?  /usr/local seems too 'root-like', and I don't really want to
> > put it into my $HOME, and give httpd the right to see in there.
> >
> > Thanks.
> >
> 
> Security 101L: Accounts should only have access to what they need. 
> Unless they are directly involved in coding the website, they should not 
> have access to /var/www/html.
> 
> You need to study up on Linux permissions (and perhaps get a Linux admin 
> to help you configure you system correctly).

Thanks, but I've administered Solaris for twenty years.

I've just never done any PhP until now.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

php includes in readable directory John Anderson <johnand982SPAM@gmail.com> - 2013-06-09 10:39 +0100
  Re: php includes in readable directory "J.O. Aho" <user@example.net> - 2013-06-09 12:59 +0200
  Re: php includes in readable directory Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-06-09 15:11 +0200
  Re: php includes in readable directory Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-09 09:16 -0400
    Re: php includes in readable directory John Anderson <johnand982SPAM@gmail.com> - 2013-06-09 15:27 +0100
      Re: php includes in readable directory Denis McMahon <denismfmcmahon@gmail.com> - 2013-06-09 20:09 +0000
      Re: php includes in readable directory Jerry Stuckle <jstucklex@attglobal.net> - 2013-06-09 16:57 -0400
  Re: php includes in readable directory Fred <fr-icsr@numericable.fr> - 2013-06-09 17:44 +0200

csiph-web