如果 htaccess 将所有内容重定向到 index.php，将 lib 文件保存在公共目录中是否安全？

Question

Is it secure to keep lib files in a public directory if htaccess is redirecting everything to index.php?

Will htaccess ever fail to redirect?

Are there any loop holes that would allow you to get to the rest of the directory tree?

Answer 1

.htaccess can fail if for whatever reason the webserver decides to stop parsing them. Maybe AllowOverride is turned on via an Apache <Directory> directive, and your website gets moved somewhere else and the <Directory> isn't updated. So now suddenly the .htaccess is off and all files are available.

If you don't want something served up by mistake, then don't place it within your site's document root. PHP couldn't care less about the webserver's document root and can access files anywhere on the system that the web server has read permissions. So keep "important" files elsewhere, which minimizes the chances of them being served up by accident.

Answer 2

If htaccess is protecting the files, there is no such loophole, backdoor, or anything that could allow access. Try accessing the files yourself from the web if you are not sure if they are protected. Redirecting people from a forbidden file is one way to do it, but I personally just 403 them right there, mainly because they are not suppose to be there.

Typically lib files don't do anything on their own (usually they are just functions or classes) so they don't pose an immediate threat if they are designed properly. A way to gaurd against this on the PHP side is to define some constant, ie define('IN_APPLICATION', true); , then at the top of all your lib files, do this check: if;defined('IN_APPLICATION) exit; .

Answer 3

If the lib files only contain functions or classes and have a file extension (eg mylibrary.php) that will be parsed as a php file then in theory there is no security implication from keeping them in the public directory since if a client requests the file the webserver will parse it and output nothing back to the client.

Example library file:

<?php
 function myfunc() {
   //do stuff
 }
?>

Executing that file will not do anything at all.