Posted by eugene2008 on 09/09/06 23:45

XAMPP, WINDOWS2003 VDS, PHP5, APACHE2

Free hosting script creates users in folder
http://pcsny.org/users/%username%

for example: if new user has login=newuser
then his directory is http://pcsny.org/users/newuser/
and http://newuser.pcsny.org


httpd-vhosts.conf looks like this

###################################################
<Directory "C:/aweb/freehosting">
Options Indexes Includes FollowSymLinks ExecCGI
AllowOverride all
Order allow,deny
Allow from all
</Directory>

<VirtualHost *:80>
DocumentRoot "C:/aweb/freehosting"
ServerName pcsny.org
ServerAlias www.pcsny.org
php_admin_value open_basedir "/"

</VirtualHost>

<VirtualHost *:80>
ServerName pcsny.org
ServerAlias *.pcsny.org
VirtualDocumentRoot
php_admin_value open_basedir "C:/aweb/freehosting/users/"

</VirtualHost>


It is working but not secure enough because of this php_admin_value
open_basedir "C:/aweb/freehosting/users/"

Bad script can see and fully control anything in folder /users/
I tried to do so php_admin_value open_basedir
"C:/aweb/freehosting/users/%1/"
Bad alas it is not so easy as with VirtualDocumentRoot

So I&#8217;ve got some questions:
1. How to lock users in their respective folders
2. How to disable user to access his web page through
http://pcsny.org/users/%newuser%/ and redirect them to appropriate sub
domain (because this way they gain full control over system)?
3. Will .htaccess in user&#8217;s folder override all my security
efforts to zero? How to prevent this without disabling .htaccess?


--
eugene2008
------------------------------------------------------------------------
eugene2008's Profile: http://techiegroups.com/member.php?userid=114
View this thread: http://www.techiegroups.com/showthread.php?t=116272

• Next in forum: Re: Extract Content Between Style Tags with Preg and PHP
• Prev in forum: Re: page commenting
• Thread view: How to fix free hosting script&#8217;s security problems on WIN VDS?

[Reply to this message]