I have a webpage that basically uses the following structure:


When I call index.php, the user is prompted to login or is logged in automatically by a session-id. index.php calls pages/a.php etc. when clicks in the navigation are done. index.php includes functions.php, which does all the right-checking-stuff in has_rights(...).

Every pages-file is kind of like this:

if(has_rights(...)) {

Whenever I open $url/pages/a.php on it's own, I get a blank page and an error-message in the log that has_rights is not defined. To the outside, this message is not visible, and there's no obvious way to get the filenames in pages. Also, pages should not be called on their own because of missing header-stuff (CSS, Javascript, ...). Is it a danger and if so, how could that be exploited?

Should every pages-file include functions.php for rights-checking, and check seperately whether it's called on it's own, or is it enough to simply fail compiling and send an empty page to the browser?

  • 5
    If page is not meant to be accessible via URL, it's best to keep it outside web server root directory. – el.pescado Jul 7 '17 at 20:44

It is enough to rely on the compilation error but it makes your webpage more error prone. For example maybe sometime you will (accidentally) enable php error output and then you will have a information disclosure. You should always make it hard to do mistakes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.