How can I disable PHP execution for a single directory?

Question

I'm installing MediaWiki as part of a static/PHP configuration and the documentation recommends that script execution privileges are revoked for the /images directory as users are able to upload files to that location. However, although I found a way to stop Python script execution (by adding Options -ExecCGI to the .htaccess file) I cannot find a way to block PHP execution.

I've tried various tricks from around the web without success:

AddType text/plain .php
RemoveHandler .php
<IfModule php5_module>php_flag engine off</IfModule> (on 3 separate lines)
<IfModule mod_php5.c>php_flag engine off</IfModule> (on 3 separate lines)

And none of these have any effect: my test file of <? echo "hello!"; ?> still gets executed when I open it in the browser.

Accepted Answer

1

Something like this in .htaccess should do it:

<FilesMatch \.php$>
    SetHandler None
</FilesMatch>

If that doesn't work, then:

Create a "symbolic link to static-only" application pointing at your images directory.
Add the app you created in step 1 to your site, using /images as the URL path.

permanent link

answered 20 Jan '13, 17:32

seanf
12.2k●4●18●36
accept rate: 37%

Thank you, that first suggestion seems to work perfectly!

(21 Jan '13, 09:30) Kylotan

Answer 2

0

You should be able to prevent execution by removing the execute bit from the directory and files in that directory.

permanent link

answered 20 Jan '13, 16:26

bmeyer71 ♦♦
1.5k●3●6●13
accept rate: 33%

If I do that, I can't navigate into the directory any more.

(20 Jan '13, 16:33) Kylotan

Just remove execute for other. You may need to leave group with execute.

(20 Jan '13, 16:41) bmeyer71 ♦♦

It still stops the web server from serving any of the files in there. I don't want to lock the whole directory - I just want to prevent script execution.

(20 Jan '13, 16:49) Kylotan

Seems a bit odd. Maybe change the permissions for the directory back to 775 and try the .htaccess example in this link about 1/3 of the way down.

(20 Jan '13, 17:04) bmeyer71 ♦♦

I already had the AddType line, which has no effect. Adding the ForceType block does nothing either, and nor does the AddHandler cgi-script idea.

(20 Jan '13, 17:24) Kylotan

How can I disable PHP execution for a single directory?

Follow this question

Related questions