apache设置中有一段
Alias /test "/var/www/web2/test"
Options FollowSymLinks Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
如果此时 /var/www/web2/test 目录中有一个php下载的页面
down.php大概是这样:
$filename=$_GET["file"]; ob_end_clean();header("Expires: 0");if(!$file = @fopen($filename,'r')){ echo 'read error'; exit();} flock($file,LOCK_SH);$filesize=filesize($filename); Header("Content-type: application/octet-stream");Header("Accept-Ranges: bytes");Header("Accept-Length: ".$filesize);Header("Content-Disposition: attachment; filename=" . $file_name);if($filesize>0){ echo fread($file,$filesize);}fclose($file);ob_get_contents();ob_end_clean();exit;
这个页面测试有很大的漏洞, 客户在浏览器输入down.php?file=../../../etc/xxx
类似的就能下载系统的文件。
请问如何配置apache让站点只能访问自身目录以及子目录,不能访问其他目录?
回复讨论(解决方案)
服务器权限!
设置suPHP就可以了,让PHP以单独用户的权限运行
if(preg_match('#\.\.\/#',$filename)){
exit;
}
apache 本身没有这个功能,也不需要这个功能
因为 apache 只是个二传手
你可以在 php.ini 中配置
open_basedir = 允许访问的路径列表
也可以将 open_basedir 放在 apache 的 httpd.conf 或 .htaccess 中
php_admin_value open_basedir 允许访问的路径列表
apache 本身没有这个功能,也不需要这个功能
因为 apache 只是个二传手
你可以在 php.ini 中配置
open_basedir = 允许访问的路径列表
也可以将 open_basedir 放在 apache 的 httpd.conf 或 .htaccess 中
php_admin_value open_basedir 允许访问的路径列表
……
good

Laravel simplifies handling temporary session data using its intuitive flash methods. This is perfect for displaying brief messages, alerts, or notifications within your application. Data persists only for the subsequent request by default: $request-

The PHP Client URL (cURL) extension is a powerful tool for developers, enabling seamless interaction with remote servers and REST APIs. By leveraging libcurl, a well-respected multi-protocol file transfer library, PHP cURL facilitates efficient execution of various network protocols, including HTTP, HTTPS, and FTP. This extension offers granular control over HTTP requests, supports multiple concurrent operations, and provides built-in security features.

Laravel provides concise HTTP response simulation syntax, simplifying HTTP interaction testing. This approach significantly reduces code redundancy while making your test simulation more intuitive. The basic implementation provides a variety of response type shortcuts: use Illuminate\Support\Facades\Http; Http::fake([ 'google.com' => 'Hello World', 'github.com' => ['foo' => 'bar'], 'forge.laravel.com' =>

Do you want to provide real-time, instant solutions to your customers' most pressing problems? Live chat lets you have real-time conversations with customers and resolve their problems instantly. It allows you to provide faster service to your custom

PHP logging is essential for monitoring and debugging web applications, as well as capturing critical events, errors, and runtime behavior. It provides valuable insights into system performance, helps identify issues, and supports faster troubleshoot

Article discusses late static binding (LSB) in PHP, introduced in PHP 5.3, allowing runtime resolution of static method calls for more flexible inheritance.Main issue: LSB vs. traditional polymorphism; LSB's practical applications and potential perfo

The article discusses adding custom functionality to frameworks, focusing on understanding architecture, identifying extension points, and best practices for integration and debugging.

Article discusses essential security features in frameworks to protect against vulnerabilities, including input validation, authentication, and regular updates.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool

SublimeText3 Chinese version
Chinese version, very easy to use

MantisBT
Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

VSCode Windows 64-bit Download
A free and powerful IDE editor launched by Microsoft