protect your tmp directory

[staartmees]

to prevent hacking or abuse of your site, it's best to protect your tmp-directory with a .htaccess-file.

Order Deny,Allow
Deny from all

Allow from 127.0.0.1

[Pierre M.]

I like this tip. I like such tips.

Pierre M.

[Nick Smart]

Thanks for your suggestion, unfortunately it prevents the captcha image from displaying on my contact form - CMSMS 1.4.1, Form Builder 0.5.3, Captcha 0.3.1, Linux/PHP5/MySQL

Nick

[cyberman]

Try this

Code: Select all

<Files *.php>
    Order deny,allow
    Deny from All
</Files>

so only executable php files will be blocked.

[Nick Smart]

Is there any reason that couldn't be added to the htaccess in the root?

Nick

[cyberman]

If you block php files from root CMSms cannot running ...

[Nick Smart]

Yes, index.php, etc. need access, I was thinking more of using it as a way to block lib, modules, plugins but just didn't write the question very well.

Nick

[cyberman]

You can use the same like I've posted for uploads folder. For /libs you can use

Code: Select all

order deny,allow
deny from all
<Files ~ ".*\.css|.*\.js|.*\.gif|.*\jpe?g|editor.php|thumbs.php|images.php|editorFrame.php$">
Order deny,allow
Allow from all
</Files>

Something more about CMSms and security you can find here

http://wiki.cmsmadesimple.org/index.php ... mall_Guide

[blast2007]

Something more about CMSms and security you can find here

http://wiki.cmsmadesimple.org/index.php ... mall_Guide

Hi all,

can you think we can add a related section into wiki guide?

Could be useful?

Regards
blast

[cyberman]

Ähmm, what you want to add ?

[blast2007]

Ähmm, what you want to add ?

Something like:

"You can add .htaccess files to protect these directories:
/tmp
/libs
/uploads
...

Here suggested configuration for each one:
...
..."

[cyberman]

On the posted link there was some informations like I've posted - now I've added the informations from this thread ...

[blast2007]

On the posted link there was some informations like I've posted - now I've added the informations from this thread ...

Ok thanks!