Skip to main content
Information Security

Return to Question

clarified question
Source Link
Aaron Adams
Aaron Adams
  • 153
  • 5

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP.

But in a directory structure such as this:

├── application
│   ├── index.php
│   └── www
├── logs
└── uploads
    └── malicious.php.jpg

Is there any way to prevent malicious.php.jpg from being evaluated as PHP if it were specified in an include(), without preventing PHP from reading/writing uploads to/from that directory?

Edit: I should probably specify that I'm interested in a configuration- or permissions-based solution.

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP.

But in a directory structure such as this:

├── application
│   ├── index.php
│   └── www
├── logs
└── uploads
    └── malicious.php.jpg

Is there any way to prevent malicious.php.jpg from being evaluated as PHP if it were specified in an include(), without preventing PHP from reading/writing uploads to/from that directory?

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP.

But in a directory structure such as this:

├── application
│   ├── index.php
│   └── www
├── logs
└── uploads
    └── malicious.php.jpg

Is there any way to prevent malicious.php.jpg from being evaluated as PHP if it were specified in an include(), without preventing PHP from reading/writing uploads to/from that directory?

Edit: I should probably specify that I'm interested in a configuration- or permissions-based solution.

Tweeted twitter.com/#!/StackSecurity/status/395934881303527424
Source Link
Aaron Adams
Aaron Adams
  • 153
  • 5

Can I limit PHP include() to specific directory trees?

I know I can use the php.ini open_basedir directive to limit the directory trees where files can be opened by PHP.

But in a directory structure such as this:

├── application
│   ├── index.php
│   └── www
├── logs
└── uploads
    └── malicious.php.jpg

Is there any way to prevent malicious.php.jpg from being evaluated as PHP if it were specified in an include(), without preventing PHP from reading/writing uploads to/from that directory?