7

My problem

I want to turn off the php engine in a specific folder, where users can upload files, but I can't seem to figure it out.

PHP Version: 5.5.26

PHP mode: php-fpm (FastCGI Process Manager)

Apache version: 2.2.29

(Server: Synology DS212j - DSM 5.2)

Anything else you need to know?


What I've tried so far:

Disable from .htaccess-file

This is not supported by php-fpm (and some other modes), it gives a 500 error, logging:

Invalid command 'php_value', perhaps mis-spelled or defined by a module not included in the server configuration.

Per-directory php.ini

I've tried per-directory php.ini-files (putting an additional php.ini-file in the avatars directory), but didn't get that working. PHP never loaded the file. Not sure what I did wrong, I tried naming it both php.ini and .user.ini, neither worked.

Main php.ini section

I also tried using a section in the main php.ini file,

[path=/path/to/secure/dir]
engine = off
max_execution_time = 300

When I did that and ran phpinfo() in a file in the secure dir the max_execution_time was set to 300 (so the file has been reloaded), but the engine was still running (I assume, since the phpinfo() was shown).

php-fpm pools

I've also read about php-fpm pools, but it seems to me that you can only specify pools by domain/vhost, am I wrong?

Edit vhost

I tried disabling it from the vhosts-file (is that what it's called?), in a <Directory /path/to/secure/dir> section as suggested here, but that wasn't supported either.


Extra info

I'm building an application based on Paniques's HUGE. In the .htaccess-file in the upload directory the php engine is turned off (for security reasons), using php_flag engine off.

Community
  • 1
  • 1
Punchlinern
  • 714
  • 5
  • 17
  • 33

2 Answers2

4

Try this .htaccess file:

<Files "*.php">
  SetHandler none
  SetHandler default-handler
  Options -ExecCGI
  RemoveHandler .php
</Files>
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

Should work both with php-fpm and mod_php.

Christopher K.
  • 1,015
  • 12
  • 18
3

You can also do something like this inside any of your httpd.conf files:

<Directory "/path/to/secure/dir">
<Files "*.*">
SetHandler !
</Files>
</Directory>

HTT Hardrain, I got this technique from his answer here: Apache: Disable php in a directory

Nick
  • 1,270
  • 1
  • 9
  • 8
  • For anyone wondering, the reason for the block is because the Apache manual notes using SetHandler None might break things like Options Indexes. – Robert Chapin Jul 13 '23 at 11:39