Admin

In Other Languages





By N2H

Jun

1

Apache htaccess Prevent Users from Uploading and Executing Files

June 1, 2008 |

There are times we want to prevent users from uploading PHP files to an unload area and then executing them. Any time you permit the uploading of files to any portion of your website, someone will attempt to take advantage of this to exploit your server. It’s inevitable, and you need to take proactive steps to prevent this from causing damage to your server.

The technique supplied here will work for a variety of different file types once you understand why it works. In particular, you want to prevent PHP files from being uploaded, because these files might contain malicious code.

RewiteEngine On RewriteCond %{REQUEST_METHOD} ^PUT$ [OR] RewriteCond %{REQUEST_METHOD} ^MOVE$ RewriteRule ^/files/(.*)\.php /files/$1.nophp

Files that are uploaded to the /files section of our website (you’ll need to modify this to point to whatever portion of your site where you’re permitting upload) with a .php file extension are created instead with a .nophp file extension, rendering them inoperable. Likewise, if someone attempts to rename an existing file to have a .php extension, this rename operation will result in the file being renamed to have a .nophp extension instead. Many well-known exploits involve this type of two-step attack, where a file is first uploaded and then executed. Preventing the initial upload goes a long way toward completely blocking these types of attacks.