PHP写入服务器上的文本文件

Question

I have a log process that writes to a little custom .txt log file on my server when people supply input on a particular form (so I can keep an eye on those who are trying to use injection).

My question: This file is plaintext, and I do not link to it anywhere in my code other than the PHP calls file_get_contents and file_put_contents . Is there any way to see the file? Would a search engine possibly find it?

(I fully understand that this is security by obscurity. My question is how one might possibly "unobscure" this.)

Answer 1

To make it inaccessible from the web or search engines you would simply put that file out site of your web root directory. Be sure to have write permission on that folder :)

Answer 2

I fully understand that this is security by obscurity. My question is how one might possibly "unobscure" this.

They would need to be able to know your site's code structure & logic. So if you name the directory the logs are stored in something other than logs/ that is the first decent step. Or keep the directory named logs/ but have it nested in another directory only you really know about such as my_cool_stuff/logs .

If you really want to be sure nobody get's to it, you can always set an Apache config rule that would block anyone from directly reading .txt files directly from the browser, just use an Apache Files directive like this in your web site's Apache config or in an .htaccess on your site:

<Files ~ "\.(txt|yml|yaml)$">
  Order allow,deny
  Deny from all
</Files>

And as the official Apache documentation states about placement of Files directives:

Note that unlike <Directory> and <Location> sections, <Files> sections can be used inside .htaccess files. This allows users to control access to their own files, at a file-by-file level.

So just place that in an .htaccess file on your server's root and it basically tells Apache, “Do not allow anyone to directly access files that end with a .txt , .yml or .yaml extension directly via the web server.”

Now some people will recommend you simply place the file 100% outside of the main web root. And maybe this would help. But let's say some malware infection gets into your code & someone can just browse your directory structure—which happens more than not—then it doesn't matter what virtual rock you hide your data under: It will be exposed to someone who can penetrate your system & have the same access rights as the web user.

Or put simply: If Apache can access a directory & read a file, then if your site is penetrated, then the malware that penetrates will have the exact same access rights as Apache & thus can read files & directories pretty much anywhere Apache can.

That's why I generally feel “security through reasonable obscurity” is the best real world tactic. Just block direct access to files you do not want parsed through the web browser, place those files in a reasonably obscure location—even if it is in the web root—and call it a day.