I have an Apache server on Windows 7 using XAMPP running php in cgi mode. One of the users can modify the .htaccess file to restrict the access to the webpage for some ip addresses and configure other settings. He cannot view the source of the php files stored in the server, and I don't want him to be able to do it.
Since php is running in cgi mode, adding
php_flag engine off to the .htaccess file does not show the source code of the php files, it just displays an internal server error. However, I am concerned that there might be another way to access the source of my files.
- Is there any way to view the source of the php files modifying the .htaccess file if php is running in cgi mode and
php_flagdoes not work?
- In case there is some way to view the source, can I fix it or the only option is to use an alternative solution and not exposing the .htaccess file?