Sorry for the newbie question...
When I go to http://www.plans4boats.com/scripts/youtubeplayer/ in Google Chrome, I can see a full listing of the files there. What should I do if I don't want any old hacker to just come in and view/copy my source codes? Does it have something to do with htaccess?
I discovered that putting a blank index.html file in the folder helps for THAT folder, but it still leaves all subfolders vulnerable.
What should I google for more information on how to set up my server to prevent this?
Just set Options -Indexes for that particular directories either in an .htaccess file or a <Directory> or <Location> container.
What you need to do is turn of Directory Listing for your specific server. I don't know what server you're using so I can't walk you through it, but just google your server name and how to disable directory listing.
I created a file called .htaccess and put the following contents:
IndexIgnore /
Related
I was just asked to work on a terrible site that the client is running off IIS. I can't make changes to the live server so I attempted to install the site on my testing server running Apache.
The site's homepage is up and running but I cannot navigate to any subdirectories. The nav menu has links like /about-us/ -- however, there is no index.php file in the about-us directory. Instead there is a file named about-us.php.
If I was getting paid to fix the site up I would do the work to rename the files and/or links, but for now I just want to get this thing running so I can make my CSS and content edits and be done with it. I assume there is some easier way (using htaccess?) to dynamically tell Apache that, when directed to a subdirectory, look for /foo/foo.php instead of /foo/index.php -- right now all I get is a directory listing or permission denied if I turn indexing off.
I've been Googling around but can't find anything that looks like the same problem -- can one of you rewrite gurus please point me in the right direction?
The best approach for you is to set the appropiate DirectoryIndex for each directory as in:
<Directory /path/to/about-us>
DirectoryIndex about-us.php
</Directory>
You can also define a single "controller" in case there is no index page found, this is done like:
FallBackResource /index.php
I just wanted to add a simple index.html to www re-direct command in an .htaccess file
When I opened the existing .htaccess file, the 'Options -Indexes' command was already in there. What exactly is this command? What is it instructing the search engines etc. to do?
Not a programmer, just an SEO manager. Thanks much, MB
The Indexes option sets whether you can "browse" the directory or not. If indexes is set to plus, and the directory has no index.html or index.php (of whatever) file, it will show the contents of the directory just like your filemanager would do. So if there are ten images in there, it simply shows them as a list with links to the actual image. You can click them and open them.
I am looking to prevent URLs for directories that don't exist from loading files with the same basename. For example http://domain.com/test/ is loading test.php. The test directory does not exist, but the file test.php does. I can see how this would be useful in most cases, but I am looking to disable it for my project.
I am on an Apache server. Is there a way to disable this option through an .htaccess file?
If there is an actual name for this type of feature, maybe "wildcard filename helper" or something like that, I'd like to know the official term too. Thanks!
This happens because MultiViews is enabled on the server.
If the apache configuration allows you to do so, you should be able to disable it by putting the following in .htaccess:
Options -MultiViews
I am running Magento Community Edition version 1.7.0.2.
I would like to know, how come are there two .htaccess
files in my installation, one in the magento root directory,
and another one in the magento app directory just beneath
the magento root directory?
On my system the first one is 209 lines long whereas the
second one only contains two directives.
Can anyone please explain how come there are two files
instead of one. Are both parsed or just one of them?
Normaly each .htaccess-File paresed, cause they could be used additional.
The last .htaccess-File may overwrite or enhanced previuos ones.
The .htaccess file in app/ is used to "deny" all access to any file under app. Without this someone could access http://yourdomain.com/app/etc/local.xml and see your database credentials, among other bad things. A similar file should be present in var/ as well (to prevent viewing logs, etc)
Delete the existing file and try adding default new .htaccess file
Magento default htaccess file
I want to stop people from viewing the contents of my images directory. I've built an app using Codeigniter and notice that they just have index.html pages with a 403 Forbidden message in all directories - is this a secure method to use? Is an index.html page in the directory sufficient or do I need to update config or .htaccess?
The .htaccess solution should work if you're comfortable using it.
Options -Indexes
If you are on a shared host with cPanel, you can change your settings in Index Manager
Cpanel - Index Manager
The index.html should be enough and secure, but it is not really a clean solution, because it is not actually returning a error message, it is probably still returning HTTP 200 and then showing the html page with error 403.
The clean solution would be adding
Options -Indexes
to the .htaccess file.
In general you need more than just an index.html, depending on you server configuration you can still get a directory listing. None of the files in the directory will be protected either.
Your best bet is to do al of the above, update the server config to limit access and also set policy via .htaccess if that is appropriate. Finally, if you don't want it to be served it really should not be part of the directory structure being published by the server.