Server Setting or PHP Script

Conrad11 · 31 May 2007 at 13:47

Hi there,

I am looking to see if there is a specific CHMOD or PHP setting so that a php page can't be opened (run) unless its included by another PHP page on the server.

Thanks.

EDIT:

Or would a token be sufficient?

marc2003 · 31 May 2007 at 14:01

have your includes directory outside of the document root then it can never be run.

Jaffa_Cake · 31 May 2007 at 14:02

When i do this I use a constant.

File:

Code:

define("SECURE", TRUE);

Protected File:

Code:

if (!defined("SECURE")) {
	die ("You cannot directly access this file"); 
}

Conrad11 · 31 May 2007 at 14:05

Jaffa_Cake said:
When i do this I use a constant.

File:

Code:

define("SECURE", TRUE);

Protected File:

Code:

if (!defined("SECURE")) { die ("You cannot directly access this file"); }

Surely doing this means I wouldn't be able to run it even if it was included?

Conrad11 · 31 May 2007 at 14:07

marc2003 said:
have your includes directory outside of the document root then it can never be run.

I have never really understood what the "root" is. Would it be outside the "public_html" folder.

Dj_Jestar · 31 May 2007 at 14:14

Yes. Outside of the directory specified in the DocumentRoot directive in the httpd.conf.

Jaffa_Cake · 31 May 2007 at 14:16

Conrad11 said:
Surely doing this means I wouldn't be able to run it even if it was included?

You declare the constant in your index file then when it includes the other file then the constant is defined in your scripts. Which means that if you put that If statement on your first line then the file can't be executed past that line unless the constant is defined from your index.

psyr33n · 31 May 2007 at 14:20

What marc2003 said.

Conrad11 · 31 May 2007 at 14:45

Jaffa_Cake said:
You declare the constant in your index file then when it includes the other file then the constant is defined in your scripts. Which means that if you put that If statement on your first line then the file can't be executed past that line unless the constant is defined from your index.

Ah I see now....clever.

And I take it that there is no way to get past this?

Jaffa_Cake · 31 May 2007 at 15:01

Conrad11 said:
Ah I see now....clever.

And I take it that there is no way to get past this?

It can only be accessed by files on the same file system which have declared the constant

Nothing from other sites and no direct access