Security: Denying direct access to files

[VBCoder]

I'd like to deny access to the include files - I know that vB tries to do this , but I'd like to do it explicitly. Other than /include/ , are there any dirs that can be denied?

[Chris M]

I believe /clientscript/ is as well

Satan

[Marco van Herwaarden]

Lol, denying clientscript, will make the board not function anymore i guess.

[Zachery]

Originally Posted by hellsatan

I believe /clientscript/ is as well

Satan

If you are that worried, why run a forum!

Serriously though.. the includes directiory doesn't contain anything that can harm your board from direct web access.

[jugo]

well a good way to prevent a file from being called by itsel:

I believe this would work:

if (eregi("filename.php",$_SERVER['PHP_SELF'])) {
   header("Location:http://www.misite.com");
   exit;
}

[Zachery]

just htaccess the directory if your worried...

[merk]

The only directory that can be locked out is includes.

[Marco van Herwaarden]

All scripts that are not ment to be called directly, are already "protected" against starting them directly, or at least protected from performing any actions.

[akanevsky]

The easy way to do this:

<Files *.php>
Order allow,deny
Deny from all
</Files>

<Files *.extension1>
Order allow,deny
Deny from all
</Files>

<Files *.anotherextension>
Order allow,deny
Deny from all
</Files>

Put this into .htaccess of every folder you want to protect.

[Chris M]

You know what I meant

I mean users cannot harm the board by accessing them directly

I misunderstood what he was asking and thought he wanted to know what directories were protected from damaging the board by users typing the url in

Satan