| Topic Archived |
View previous topic :: View next topic |
| Author |
Message |
NEMINI Diamond Supporter


Offline Joined: Apr 22, 2004 Posts: 4551
|
Posted: Tue Nov 02, 2004 5:09 am Post subject: Re: What are security issues if using blank htaccess? |
|
if your host runs php from cgi that line should be moved to php.ini ... most shared hosts run php as cgi for additional security, I knew the answer cause I had that issue way back when it was added back during v1.14 I think
_________________ NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org
NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) 1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
|
|
| Back to top |
|
 |
chris333 Nice poster


Offline Joined: Jun 06, 2004 Posts: 52 Location: Luxembourg
|
Posted: Tue Nov 02, 2004 5:10 am Post subject: Re: What are security issues if using blank htaccess? |
|
ok thx, wow you are always so fast and know a lot, thx again
_________________ www.nukecommunity.com
chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
|
|
| Back to top |
|
 |
DJ Maze Developer


Offline Joined: Apr 19, 2004 Posts: 5683 Location: http://tinyurl.com/5z8dmv
|
Posted: Tue Nov 02, 2004 5:12 am Post subject: Re: What are security issues if using blank htaccess? |
|
Your server is setup to disallow modifications on how PHP works.
Using that line we tried to block the use of registering globals.
example: index.php?get=me
when register_globals is on PHP creates a variable $get with the value 'me'
this could be used as a huge security exploit.
If PHP is default set to register_globals = 0 then you don't have to worry.
Ask your host for the proper setup
DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
|
|
| Back to top |
|
 |
NEMINI Diamond Supporter


Offline Joined: Apr 22, 2004 Posts: 4551
|
Posted: Tue Nov 02, 2004 5:13 am Post subject: Re: What are security issues if using blank htaccess? |
|
been using cvs since before 8.2a came out so I've learned as it's changed rather then having to learn everything at once. I screw things up a lot but then I'm not afraid to screw up, I just try to remember and learn as I go, my last resort is seeking help. Which, while it may not be as public, does happen plenty often.
_________________ NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org
NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) 1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
|
|
| Back to top |
|
 |
chris333 Nice poster


Offline Joined: Jun 06, 2004 Posts: 52 Location: Luxembourg
|
Posted: Tue Nov 02, 2004 5:17 am Post subject: Re: What are security issues if using blank htaccess? |
|
thx for the informations dj
i had to remove another line to get it work
i changed this:
Options FollowSymLinks -Indexes
to this:
#Options FollowSymLinks -Indexes
what does this bit of code do? is this the mod rewrite function?
_________________ www.nukecommunity.com
chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
|
|
| Back to top |
|
 |
DJ Maze Developer


Offline Joined: Apr 19, 2004 Posts: 5683 Location: http://tinyurl.com/5z8dmv
|
Posted: Tue Nov 02, 2004 5:23 am Post subject: Re: What are security issues if using blank htaccess? |
|
This option prevents directory listing.
When "Indexes" is on and a directory doesn't contain index.htm or index.php (or home.)
The directory will be show as a FTP directory.
DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
|
|
| Back to top |
|
 |
chris333 Nice poster


Offline Joined: Jun 06, 2004 Posts: 52 Location: Luxembourg
|
Posted: Tue Nov 02, 2004 5:35 am Post subject: Re: What are security issues if using blank htaccess? |
|
ok if i understand it right, this means that this line will show an ftp folder if there is no index / home file in the folder, but it's the nuke root path, most of the time there is such a file in that folder. so wouldn't it be better to add this symbol # as default to block that line. During installation of cpg nuke you could explain the user that if he changes the name of index.php and also in the config file then he should also uncomment that line?
_________________ www.nukecommunity.com
chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
|
|
| Back to top |
|
 |
NEMINI Diamond Supporter


Offline Joined: Apr 22, 2004 Posts: 4551
|
Posted: Tue Nov 02, 2004 5:36 am Post subject: Re: What are security issues if using blank htaccess? |
|
it affects all directories not just root.
_________________ NEMINI.org, NEMINI.us, NEMINI.info, NYMINI.org
NEMINI's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) 1.3.34 (Unix)/4.1.18-standard/4.4.2 /9.1.0.8 CVS
|
|
| Back to top |
|
 |
chris333 Nice poster


Offline Joined: Jun 06, 2004 Posts: 52 Location: Luxembourg
|
Posted: Tue Nov 02, 2004 6:14 am Post subject: Re: What are security issues if using blank htaccess? |
|
ok now it works i forgot to check the whole htaccess file, at the end there was the following code:
# disallow index viewing (like ftp) of directory
Options FollowSymLinks -Indexes
# for hosts that don't allow the above, we won't give people anything to look at
# IndexIgnore *
i changed it as indicated to this:
# disallow index viewing (like ftp) of directory
# Options FollowSymLinks -Indexes
# for hosts that don't allow the above, we won't give people anything to look at
IndexIgnore *
now everything is fine
_________________ www.nukecommunity.com
chris333's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) DebianGNU/1.3.31/4.0.18/4.3.4/8.3 CVS
|
|
| Back to top |
|
 |
coldfire_1989 Nice poster


Offline Joined: Jul 05, 2004 Posts: 129 Location: Canada
|
Posted: Tue Nov 02, 2004 2:12 pm Post subject: Re: What are security issues if using blank htaccess? |
|
okie folks, I've a stupid question.  How can I remove that Forbidden error from my folders, when I go on any folder it give some the 403 error., i.e mastmp3.com/users/CoLdFiRe_89, I'm using an My_Upload module on my site, and when any user tryes to go in their folder to see wat they have uploaded it gives them an error. is there any way to give  permisisons to /users folder and the folders in it.
coldfire_1989's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) Linux/1.3.33/4.0.23/4.3.9/9.0.3
|
|
| Back to top |
|
 |
DJ Maze Developer


Offline Joined: Apr 19, 2004 Posts: 5683 Location: http://tinyurl.com/5z8dmv
|
Posted: Tue Nov 02, 2004 4:47 pm Post subject: Re: What are security issues if using blank htaccess? |
|
use "Options FollowSymLinks -Indexes" in the that specific directory the other way round.
Info is available at apache.org
DJ Maze's server specs (Server OS / Apache / MySQL / PHP / DragonflyCMS) Fedora 15 / 2.2.22 / 5.5.20 / 5.3.10 / CVS
|
|
| Back to top |
|
 |
|
|