It's for your own safety !

Discussion in 'Apache' started by Ed Dyreen, Jul 11, 2012.

  1. #1
    '
    I also posted this question at a php forum but didn't get a lot of response, you could say, I'm a little impatient...

    My server recently made some serious changes,
    As a result I suffered the famous php download application/x-httpd-php file browser error.
    After hours of searching I finally resolved the issue editing my .htaccess file from
    
    AddHandler php5-script .php
    SetEnv PHP_VER 5
    
    Code (markup):
    to
    
    AddHandler x-httpd-php5 .php
    SetEnv PHP_VER 5
    
    Code (markup):
    But soon after, I discovered another problem, In the past I could simply create folders and if they did not contain an index file, the apache server would give me a nice overview of the contents.
    Well, now it gives me a forbidden or not found error.

    I read on the net this could be simulated with a php file,
    but when I tried it I noticed the '@opendir($path)' would simply fail.

    I did not cause the above issues as it worked before until my host decided to make some unknown changes.

    Now I am stuck with the 'httpd.conf' file, this is what I have
    
    <Directory "/some-site.com/www/php">
    Options Indexes MultiViews FollowSymLinks
    IndexOptions FancyIndexing
    AllowOverride none
    order allow,deny
    allow from all
    </Directory>
    
    Code (markup):
    I don't even know where to place this file so I placed it in the root folder of my host, where .htaccess is.
    I also don't know wheter '<Directory "/some-site.com/www/php">' is correct because to browse it I used to go to 'www.some-site.com/php/'. I also tried 'http://www.some-site.com/php/' and '/php' to no avail.

    Most solutions I see on the web are for people running apache from home which is not the case with me.
    This is why I have difficulties accessing the log, when I acces the server using ftp, there is a folder called log,
    but it only contains webanalizer which I do have acces to through my providers site, no logFile though...

    Any help is greatly appreciated, as I wasted too much time already and am frustrated now. :yawn:
    I am new and noobish so it's probably something simple :)


    Thanks in advance,
     
    Ed Dyreen, Jul 11, 2012 IP
  2. Ray Baron

    Ray Baron Member

    Messages:
    148
    Likes Received:
    10
    Best Answers:
    3
    Trophy Points:
    43
    #2
    Visitors being able to list the contents of a directory is generally considered to be a security risk which is probably why your host changed that behavior. If you want that behavior you can add this to an .htaccess file:

    Options +Indexes

    It sounds like you're on a shared host so you can't do anything with httpd.conf. That is a server-level apache configuration file.

    You may, however, put all of those commands in an .htaccess file in the web space root folder.
     
    Ray Baron, Jul 12, 2012 IP
  3. andrekhrisna

    andrekhrisna Active Member

    Messages:
    191
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    53
    #3
    Contact your hosting provider and tell them to fix it.
    They are there to help you. ;)

    Success for you.
     
    andrekhrisna, Jul 12, 2012 IP
  4. Ed Dyreen

    Ed Dyreen Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Hey man, thanks for responding, I really appreciate it !
    I must be going mental, I could have sworn I tried that ?!
    I placed a .htaccess file inside the folder I want to be browsable.
    I believe this will make only this folder and it's children browsable and not the parent folder right ?
    I wouldn't wan't people to browse my entire domain.

    I have some difficulties understanding what you are trying to say,
    I also don't see what it is that I said that makes you believe so.
    I am registered at _www.livedomain.com

    Also I would have preferred the 'httpd.conf' but I didn't got it working yesterday.

    I did send a mail to livedomaine technical support,
    I believe that making site breaking changes without pre-informing your clientele about it,
    nor informing them on how to anticipate is not done and rather arrogant.


    Live long and prosper :)
     
    Ed Dyreen, Jul 12, 2012 IP
  5. Ed Dyreen

    Ed Dyreen Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    '
    Whoea, something terrible has happened,

    so I dropped this file '.htaccess' inside the folder I want people to browse
    
    Options +Indexes
    
    Code (markup):
    But now my entire domain has become browsable, I only want this one specific folder to be browsable :(

    Here is some additional info I think may be of relevance
    
    [TABLE]
    [TR]
    [TD="class: e"]Server API[/TD]
    [TD="class: v"]CGI/FastCGI[/TD]
    [/TR]
    [TR]
    [TD="class: e"]Virtual Directory Support[/TD]
    [TD="class: v"]disabled[/TD]
    [/TR]
    [TR]
    [TD="class: e"]Configuration File (php.ini) Path[/TD]
    [TD="class: v"]/etc/php5/cgi[/TD]
    [/TR]
    [TR]
    [TD="class: e"]Loaded Configuration File[/TD]
    [TD="class: v"]/etc/php5/cgi/php.ini[/TD]
    [/TR]
    [TR]
    [TD="class: e"]Scan this dir for additional .ini files[/TD]
    [TD="class: v"]/etc/php5/cgi/conf.d[/TD]
    [/TR]
    [/TABLE]
    
    Code (markup):
    I created a 'httpd.conf' file, I think this should work..
    
    <Directory "/www/public">
    Options +Indexes
    AllowOverride none
    order allow,deny
    allow from all
    </Directory>
    
    Code (markup):
    But where do I drop this file on the server ?

    I find myself fighting with my browsers cache And apache who is restarted remotely I seem to have no control over it when I like it to reinitialize.
     
    Last edited: Jul 13, 2012
    Ed Dyreen, Jul 13, 2012 IP
  6. Ray Baron

    Ray Baron Member

    Messages:
    148
    Likes Received:
    10
    Best Answers:
    3
    Trophy Points:
    43
    #6
    Check to make sure your host didn't put something in the root folder's htaccess. If you create an htaccess in a subfolder, it will not be applied to any folder above -- only to the folder it is in and the folders below.

    You're not going to be able to use httpd.conf on shared hosting. Where it goes is somewhat dependent on the platform. It is in /usr/local/apache/conf/ on CPanel servers, for example. Regardless you will not have access on a shared server.

    You can put those commands as-is in an htaccess. Put the htaccess file in the folder you want to show the directory index for. (It will also display the files in the subfolders.)

    That said, I doubt that /www/public is valid. More likely, your path is /home/<domain>/public_html, or /var/www/<user>/public_html or something similar.
     
    Ray Baron, Jul 13, 2012 IP
  7. Ed Dyreen

    Ed Dyreen Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    '
    I think I got it working now, the key was I needed a '.htaccess' file for the browsable folder with Options +Indexes
    AND a '.htaccess' file in the root www folder with Options -Indexes.
    Otherwise it would browse all or none, yes I know it's weird but I'm not lying !?

    I don't know why you keep saying I have 'shared' hosting. Where do you draw this conclusion from ?
    Well, I don't know what it means either so ...

    Seems you are right on the 'httpd.conf' file though, nomatter where I drop it nomatter the contents, it won't work.

    Regards and thanks,
    I think it is completely solved now :)
     
    Ed Dyreen, Jul 13, 2012 IP
  8. Ray Baron

    Ray Baron Member

    Messages:
    148
    Likes Received:
    10
    Best Answers:
    3
    Trophy Points:
    43
    #8
    Glad its working!

    Shared hosting is just hosting through web hosts like BlueHost, GoDaddy, etc, that are not VPSs. Its not a 'knock.'

    The main reason you have to distinguish between shared hosting and private hosting (VPS, dedicated server) is that with the former you have no shell access and you cannot configure apache. You can modify apache's behavior through htaccess, but it is quite limited compared to what you can do on a VPS.
     
    Ray Baron, Jul 13, 2012 IP