My hoster placed a
.user.ini in my
public_html. What is the recommended file permission be? Now it's
Since PHP 5.3.0, PHP includes support for configuration INI files on a per-directory basis. These files are processed only by the CGI/FastCGI SAPI. This functionality obsoletes the PECL htscanner extension. If you are running PHP as Apache module, use
.htaccessfiles for the same effect.
It doesn't seem quite recommendable per se to allow such files that enables changing PHP settings with same privileges that are used by a web application, although the possible
php.ini directives are limited:
Only INI settings with the modes
PHP_INI_USERwill be recognized in
.user.ini-style INI files.
As the file is inside the document root, it's recommended to limit the access to it from the web i.e. you shouldn't be able to access it using
http://example.com/.user.ini type URLs. You should check that. The required Apache configuration would be:
<Files ".user.ini"> Require all denied </Files>
The file permissions doesn't affect this that much, as it would be probably accessed using the user's own account. However, with
644 everyone having local access to the server can read this configuration file.
If this is a cPanel hosting, there's interesting details about their implementation on cPanel forum: custom .user.ini files with FastCGI:
If you want the file to be unreadable, make it 0400 (or 0600). Here is a quote from one of our developers that better explains this:
This behavior is by design. Since the file is readable by all users, it is readable by the user in question. When saving files, to avoid problems when the user is over quota, we write to a temporary file, and if that was successful, rename(2) the file into place. Since the user has write permission in this directory, the rename is successful and the old file, along with its permissions, is destroyed.