如何限制从所有子目录查看php.ini？

Question

I'm currently able to alter .htaccess file as such to prevent opening of the php.ini and other files via a web browser:

# Prevent .ini and other files from being open from web browser
<filesMatch "\.(htaccess|htpasswd|ini|log|sh)$">
 Order Allow,Deny
 Deny from all
</filesMatch>

But this seems to work only for the root directory, where I place this .htaccess file, so if I navigate to www.mysite.com/sub/php.ini it can still open that file.

Any idea how to make a filter for all such files in all subdirectories?

Answer 1

You could add this to your apache configuration httpd.conf, or to your .htaccess itself.

<Files "*.ini">
    Require all denied
</Files>

Or this would work as well:

<Files "*.ini">
    Order Allow,Deny
    Deny from all
</Files>

If you want to keep it the format you have at the moment, you could do this:

<filesMatch ".*\.(htaccess|htpasswd|ini|log|sh)$">
    Order Allow,Deny
    Deny from all
</filesMatch>