当前位置：文江博客话题详情

如何防止使用 .htaccess 或自定义 php.ini 覆盖设置

发布于 2024-12-11 05:42:47 字数 58 浏览 0 评论 0原文

如何确保用户无法使用 .htaccess 或自定义 php.ini 覆盖设置我应该使用的任何配置提示

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

数理化全能战士 2024-12-18 05:42:47

为了防止用户在 .htaccess 文件中设置 PHP 配置值，请不要授予其虚拟主机上的 AllowOverride Options 权限。

或者，将 PHP 安装为 CGI 而不是 Apache 模块，因为 CGI 版本不受 .htaccess 文件的影响。但是，从 PHP 5.3.0 开始，PHP CGI 确实会解析每个目录的 php.ini 文件。我不知道有什么方法可以关闭此功能。

编辑：我刚刚在最新的默认 php.ini 中看到了这一点：

; Directives following the section heading [PATH=/www/mysite] only
; apply to PHP files in the /www/mysite directory.  Directives
; following the section heading [HOST=www.example.com] only apply to
; PHP files served from www.example.com.  Directives set in these
; special sections cannot be overridden by user-defined INI files or
; at runtime. Currently, [PATH=] and [HOST=] sections only work under
; CGI/FastCGI.
; http://php.net/ini.sections

因此，如果您将指令放在主 php.ini 中的每个目录标题下，则它们不能被覆盖。然而，缺点是您必须为每个虚拟主机执行此操作，因此在有许多虚拟主机或经常添加新主机的环境中，它将成为 PITA。

再次编辑：

进一步阅读揭示了这一点：

; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini"
;user_ini.filename = ".user.ini"
; To disable this feature set this option to empty value
;user_ini.filename =

因此只需取消注释最后一行即可禁用每用户 ini 文件。 :-)

To prevent users setting PHP config values in .htaccess files, do not give AllowOverride Options permissions on their virtual hosts.

Alternatively, install PHP as CGI instead of as an Apache module, as the CGI version is unaffected by .htaccess files. However, since PHP 5.3.0, PHP CGI does parse per-directory php.ini files. I am not aware of a method that turns this off.

EDIT: I've just seen this in the latest default php.ini:

; Directives following the section heading [PATH=/www/mysite] only
; apply to PHP files in the /www/mysite directory.  Directives
; following the section heading [HOST=www.example.com] only apply to
; PHP files served from www.example.com.  Directives set in these
; special sections cannot be overridden by user-defined INI files or
; at runtime. Currently, [PATH=] and [HOST=] sections only work under
; CGI/FastCGI.
; http://php.net/ini.sections

So if you put directives in your main php.ini under per-directory headings they cannot be overridden. However, the downside is that you'll have to do this for every virtual host so it'll be a PITA in environments where there are many or where new ones are frequently added.

EDIT AGAIN: