PHP - 保护站点免受具有 777 权限的文件夹的侵害
通常，我尝试将文件夹设置为具有 775 权限，但某些 Web 托管拒绝让 PHP 写入或将文件移动到任何文件夹，除非它具有 777 权限（可能是 open_dir 或安全模式）。
是否有任何方法可以防止从此类文件夹运行任何 PHP 文件，以防恶意 PHP 脚本上传到那里？
Usually, I try to set my folders to have permission 775, but some web-hosting refuses to let PHP writes or move files to any folders unless it has permission 777 (it may be open_dir or safe mode).
Are there any ways to prevent any PHP files from being ran from such folders, in case a malicious PHP script has been uploaded there?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
实际上，如果您的主机不需要 777，请查找不同的主机
它是可写的。事实上，如果 PHP 脚本可以写入一个文件夹
是 755（suexec、suPHP），这实际上与拥有所有文件夹相同
777. 因此，为了安全起见，您想要的是一个需要 777 的主机
使文件夹可写。
这样想吧 - 几乎所有文件夹默认都是 755。如果脚本
可以写入755个文件夹，这意味着任何脚本都可以写入任何文件夹！
如果脚本只能写入 777 个文件夹，则意味着只能写入
到他们应该的文件夹。如果您要允许写入
所有目录，它们也可能都是 777，所以这就是不可原谅的
危险的。
仅是一位拥有 15 年执业经验的安全专业人士的意见
的经验。
Actually, find a different host if your host does NOT require 777 for
it to be writeable. In truth, if PHP scripts can write to a folder that
is 755 (suexec, suPHP), that's effectively the same as having ALL folders
777. So what you want, for security, is a host who requires 777 in order
to make the folder writeable.
Think about it this way - almost all folders are 755 by default. If scripts
can write to 755 folders, that means any script can write to any folder!
If scripts can write only to 777 folders, that means that can only write
to the folders they are supposed to. If you're going to allow writes to
all directories, they may as well ALL be 777, so that's what's inexcusably
dangerous.
Just the opinion of one licensed security professional with fifteen years
of experience.
您可以对该目录禁用 PHP。请参阅此答案。< /a>
You could disable PHP for that directory. See this answer.
雷的评论没有道理。持有执照的安全专业人员？由所有者创建的脚本应该能够写入 755 个文件夹！请参阅http://www.zzee.com/solutions/linux-permissions.shtml
原来问题的答案......很简单。在 .htaccess 中使用 php_value auto_prepend_file 就可以了。只需创建一个终止 [die() 函数] 的简单脚本，并在 .htaccess 中定义它；从这样的目录调用的每个 PHP 脚本都不会被执行。您甚至可以配置“kill”脚本，以便在每次发生可疑情况时（当某些内容试图从“受保护”目录调用 PHP 脚本时）向您发送电子邮件。
Ray's comment doesn't make sense. A licensed security professional? Scripts that are created by owner should be able to write to 755 folders! See http://www.zzee.com/solutions/linux-permissions.shtml too!
And the answer to the original question... It's easy. using php_value auto_prepend_file within .htaccess will do it. Just create a simple script that terminates [die() function], define it within .htaccess; each PHP script called from such a directory will not be executed. You can even configure that "kill" script to email you each time something suspicious happens (when something is trying to call PHP scripts from the "protected" directory).
禁用脚本执行 您还可以尝试在所有文件所在的上传文件夹上禁用脚本执行。您可以通过在文件夹上写入 .htacess 文件来完成此操作。
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi
选项 -ExecCGI
Disable Script Execution You can also try to disabled script execution on the uploaded folder where all the files go. You can do this by writing a .htacess file on the folder.
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGI