限制WAMP文件系统访问

Question

I have a WAMP stack installed in my PC. Yesterday, I was working with file system with PHP and noticed that I can access any directory in my hard disk even above the website document root directory. This is a clear security issue that I want to avoid.

Currently, I am using several virtual hosts in my WAMP stack along with custom domain using hosts file.

I am looking for some configuration that I can made in httpd.conf file or better if possible in .htaccess file that will limit the access of scripts in various sites to their document root. It will be better if the code doesn't require any changes when I add or remove virtual hosts.

Answer 1

People should not ever be able to access folders you haven't allowed in any virtual hosts in conjunction with the .htaccess files

If you have a virtual host, say ben.mydevelopment which routes to a certain folder, there will be no way to "go up", you cannot access folders "above" that one.

You can use the .htaccess file to deny access to certain folders by using

Deny from all

and placing it in the relevant folders. You cannot block a whole filesystem since apache shouldn't serve you entire filesystem to start with.

Can you list the folders that you've been able to gain access to and the ones on which apache are running (either through the main config or virtual hosts)?

(Note: Also, I wouldn't worry too much about people being able to access your data, most firewalls deny inbound connections over HTTP and almost all home routers refuse inbound connections and don't know which computer to connect them to, so unless you've intentionally tried to setup you're own live web server, then you should be fine)