I'm playing on
www.example.com/index.php but when I added (~) at the end:
www.example.com/index.php~, a file with name
index.php started downloading.
As others have mentioned, many text editors (most notably Emacs, I'd say) back up earlier versions of files you work on by creating another file whose name is the same as the original but with a tilde appended.
What other answers haven't stressed enough, however, is that the fact that you can access such a file is a consequence of some mix of incorrect version control or incorrect build and deployment.
Incorrect version control (neglect of "ignore" files)
Version control systems (VCS) have mechanisms to configure a repository so that the VCS filenames that match specified patterns will be ignored. The most popular version control system today is Git, and its mechanism for this is special files named
.gitignore. Most source code Git repositories ought to have a top level
.gitignore file that has this line in it:
That's a pattern telling Git to ignore all files whose name ends with a tilde. A common mistake among developers is to not maintain these files diligently, or just completely ignore them. For example, many IDEs will pop up a warning when they find untracked files in your source tree and give you the option of telling the IDE to ignore them. You should almost never use that option; instead, figure out what to put in the repo's "ignore" file so that everybody who checks it out automatically gets set up to never check these files in.
Disciplined use of such "ignore" files goes a very long way to protecting you from many other security problems. For example they can help protect you against the common problem of developers accidentally checking in secret credentials. One practice I've found useful is to adopt a standard layout where you projects have a designated directory for developers to place such files. You can then set up your VCS repository so files in that directory are ignored, and design your application so that development builds will get their configuration from there.
Incorrect build and deployment processes
The other thing that is likely to cause problems like that is build and deployment processes that incorrectly propagate files like the
index.php~ in question.
Some practices that should be adopted to avoid this:
- Get your version control system to ignore the files in the first place, as mentioned above.
- Have an automated build system that periodically checks out your project from source control, builds and packages it for deployment.
- Never edit files in the build system's work directory, so that its copy of the source repository is always clean. Always observe the discipline that developer environments are separate from automated build environments.
- Never build releases from developers' own environments.
Another important tip is to use battle-tested build tools to build your projects, that enforce a rational project layout and have some good story on how to identify which files should be packaged and which not. The build tools for many languages, for example, instead of just blindly archiving everything in your source repository, will selectively copy files from it into a temporary staging directory, and then archive that, so that only files that the tool explicitly selected for inclusion get included.
example.com/index.php~could be a server without PHP sending content from a string, a database, etc., with a HTTP header telling the browser a filename. The fact that the downloaded file doesn't have the ~ on the end (unless that's your typo?) suggests this is more likely the case. (i.e. this is not a ~ at the end of a file extension, it's a ~ at the end of a URI).