CODEWITHSUNDEEP
php.htaccesssecurity
user1440978
user1440978

Reputation: 73

.htaccess: prevent php scripts from accessing parent/sibling directories

I'm not particularly experienced with .htaccess (outside of simple mod_rewrite, and basic deny/access), and am unsure of how to approach the following issue:

I have a directory structure as follows:

/parentDirectory
    /childDirectoryOne
    /childDirectoryTwo

I have a domain that points to /parentDirectory (we'll call it parent.com), and seperate subdomains for each of the children directories (we'll call them one.parent.com and two.parent.com respectively).

These are all located on a shared host. I need to be able to grant ftp access to the subdirectories, but the problem is right now, someone could upload a php file to a childDirectoryOne that scans the parent directory, thereby discovering its sibling direcotry, and can then move into the sibling directory and get sensitive information from files (like a dbConfig file).

What I have been attempting to do (with no success so far) is develop a set of .htaccess files that would prevent the scripts in the children directory from accessing the parent or sibling directories. I'm not even sure if this is possible. Unfortunately, my shared host has no support for setting up a chroot jail, so this is my last option for finding a solution (next to purchasing hosting for each and every ftp user so they can't access others information).

Upvotes: 3

Views: 2363

Answers (2)

T.Todua
T.Todua

Reputation: 56371

NOTE!

You need to utilize safe_mode too, otherwise with shell(),exec()... you will be hacked.... BUT!! that's not enough. Read here fully - https://puvox.software/blog/restrict-php-access-upper-directory/

Upvotes: 1

Jonathan Wren
Jonathan Wren

Reputation: 3712

It's considered bad practice to allow read, write and execute permissions to a folder to people you don't absolutely trust.

The ability to upload an arbitrary script and execute it on the server is a very big deal (them accessing another folder is the least of your worries). People can completely destroy your server and all sites on it, access your db, overwrite other pages in any site, and the list goes on.

I would recommend disabling php entirely for uploaded files. You can put this in your .htaccess. 

php_flag engine off

That being said, if you really want to do it this way, you can use the open_basedir. 

<Directory /parentDirectory/childDirectoryOne>
  php_admin_value open_basedir "/parentDirectory/childDirectoryOne"
</Directory>

Upvotes: 1

Related Questions