Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

htaccess for subdirectories to prevent script execution

Tags:

php

I have sub directory 'images' with permission 777 to upload images from visitors in this folder there is .htaccess file to prevent script execution and more security

<Files ^(*.jpeg|*.jpg|*.JPEG|*.JPG|*.png|*.gif)>
    order deny,allow
    deny from all
</Files>

<FilesMatch "\.(php|pl|py|jsp|asp|htm|shtml|sh|cgi)$">
ForceType text/plain
</FilesMatch>

But when i request images/page.php in browser, it is working which is meaning .htaccess does not working. I want to prevent this folder from executable file.

Is there any mistake in my .htaccess file

like image 378
user1799572 Avatar asked Nov 21 '25 07:11

user1799572


1 Answers

One more comment here, I would advise to case insensitive check for your scripts rule, that would be:

<FilesMatch "(?i)\.(php5|php4|php|php3|php2|phtml|pl|py|jsp|asp|htm|shtml|sh|cgi)$">
    ForceType text/plain
</FilesMatch>

This works fine for our server.

like image 174
Vasily Bezruchkin Avatar answered Nov 22 '25 21:11

Vasily Bezruchkin