如何保护正在执行的上传文件夹中的文件

Question

I have a upload folder where users can upload anything, all file types are allowed...

But, there is a problem...

If user upload .php file, that file won't be offered to download it, it will be executed, so if user upload dangerous php file, that will delete folders, or browse, or display secured data, it will do that, so anyone can have access to server...

How can I protect executing in that folder?

I try with CHMOD 755 for that folder, but then files can't be uploaded...

Is there any way to protect this without php scripts or file type checking while upload or something, just to block executing in that specific folder...

Maybe with .htaccess or something?

Thank you...

Answer 1

将目录放在公共www-scope之外，并使用脚本使用file_get_contents或类似方法获取文件。

Answer 2

My first inclination is to say "Don't do that!".

But if you must do it for whatever reason: upload the files into a directory that's not accessible by Apache. Then write a script that reads the files and outputs their contents.

It's still a bad idea IMHO. That doesn't prevent someone from using Javascript to do all sorts of nasty things to other users.

Edit Based on your comments I'm adding a bit to my answer:

You have to remember that on the web there are multiple layers of "execution", and really it's interpreted, but I won't argue semantics. If Apache serves your file and it is designed to be interpreted by Apache, Apache will interpret it (usually a scripting language such as PHP). If you download a file designed to be interpreted by the browser (HTML, Javascript, CSS), it will be interpreted by the browser and all of the programs that go along with that.

If you can't use a script to read the file (which will only prevent Apache from doing something with it) you could have your uploader ZIP the file. That way it's always being downloaded in the correct format.

Answer 3

Put this in the .htaccess of the folder to disable PHP:

php_flag engine off

In case you're using FastCGI or not mod_php :

RemoveHandler .php

Answer 4

Why dont you filter php files? do you really need your users uploading php file? you can filter for known dangerouns extensions.