Apache and ServerSide

[Justin]

How do i configure my server (or use an htaccess file) to tell the server to NOT allow exicution of php, cgi, pl, shtml ... Basically How do i disable any server side scripts within a directory. I have given a few people a public dir to upload files to on the server, but i want to disable that ability. I can either put it in the config file or put it in an htaccess file in the parent dir (which they don't have access to). (ps its on a windows box)

P.S. I do want them to be able to upload thoes kind of files and let them be displayed like normal txt files.

[Stephen Philbin]

You should have the following lines in your httpd.conf file


LoadModule php5_module modules/libphp5.so
AddType application/x-httpd-php .php


They are what tell Apache to pass php files to the PHP parser. Leave them as they are. Just after those lines, put the following


<Directory "Path to the folders of the users you want affected.">
Options Indexes
DirectoryIndex none
AddType application/x-httpd-php-source .php
</Directory>


That'll tell Apache to pass .php files to the PHP module for parsing into syntax highlighted PHP code, rather than usual processing. I use a vaguely similair thing on my own domain: you can browse my domain as normal or you can stick /source immediately after domain name to see all source code (including the PHP source).

So for example http://www.stephenphilbin.com/test/entities.php brings up a throw-together that gives a quick reference to some common entities, but http://www.stephenphilbin.com/source/test/entities.php shows the syntax-highlighted php code that makes the normal page.

If you do not want the syntax highlighted stuff and you just want it as plain text like you said, then you could just put
<Directory "Path to the folders of the users you want affected.">
Options Indexes
DirectoryIndex none
AddType text/plain .php
</Directory>


in your httpd.conf file instead.