This article is a mirror article of machine translation, please click here to jump to the original article.

View: 12808|Reply: 0

[Web] Prohibits cross-directory browsing under Apache

[Copy link]
Posted on 7/9/2015 11:53:27 PM | | |
  1. <Directory /www/web/test>
  2.     Options FollowSymLinks
  3.     AllowOverride All
  4.     Order allow,deny
  5.     Allow from all
  6. </Directory>
Copy code
When we visit a website, add the corresponding directory at the end, and we can browse to the directory, which is very insecure for the website.
   
    Solution:
        1. Edit the httpd.conf file
            vi ./conffile:///C:\Users\lenovo\AppData\Local\Temp\@IR3P(8S$C$Z$TY~5I{QEPC.giftpd.conf

   Find the following:
          ......
          <Directory "C:/Program Files/Apache2.2file:///C:\Users\lenovo\AppData\Local\Temp\@IR3P(8S$C$Z$TY~5I{QEPC.gifdocs">
              #
              # Possible values for the Options directive are "None", "All",
              # or any combination of:
                 Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
              #
              # Note that "MultiViews" must be named *explicitly* --- "Options All"
              # doesn't give it to you.
              #
              # The Options directive is both complicated and important.  Please see
              # http://httpd.apache.org/docs/2.2/mod/core.html#options
              # for more information.
              #
              Options Indexes FollowSymLinks

              #
              # AllowOverride controls what directives may be placed in .htaccess files.
              # It can be "All", "None", or any combination of the keywords:
              #   Options FileInfo AuthConfig Limit
              #
              AllowOverride None

              #
              # Controls who can get stuff from this server.
              #
              Order allow,deny
              Allow from all

          </Directory>
          ......

   In Options Indexes FollowSymLinks, prefix the Indexes with a - symbol.
        Namely: Options -Indexes FollowSymLinks
   [Note: Before Indexes, add + means that the table of contents is allowed to browse; Plus - Represents prohibited catalog browsing. 】

    In this case, the entire Apache prohibited directory browsing.

    In the case of virtual hosting, just add the following information:
           <Directory "D:\test">
             Options -Indexes FollowSymLinks
             AllowOverride None
             Order deny,allow
             Allow from all
         </Directory>
     In this case, it is forbidden to browse the directory under the test project.

Note: Remember not to change "Allow from all" to "Deny from all", otherwise, the entire website will not be opened.

http://morgan363.javaeye.com/blog/645363


How does Apache block the directory list while keeping the default page for directory access?
Keywords: php
Find the directory attribute that needs to be set in the Apache configuration file httpd.conf, and remove the indexes in the Options line  
  For example:  
  <Directory   "d:\web">  
          Options   Indexes   FollowSymLinks  
  </Directory>  
  Changed to:  
  <Directory   "d:\web">  
          Options   FollowSymLinks  
  </Directory>  

-----------------------------------------------------------------
Alias   /edit/   "/home[img]file:///C:\Users\lenovo\AppData\Local\Temp\~(H)[A[}_FC3OBSP~]S`RV8.gif[/img]php[img]file:///C:\Users\lenovo\AppData\Local\Temp\~(H)[A[}_FC3OBSP~ ]S`RV8.gif[/img]/"  
   
          <Directory   "/home[img]file:///C:\Users\lenovo\AppData\Local\Temp\~(H)[A[}_FC3OBSP~]S`RV8.gif[/img]php[img]file:///C:\Users\lenovo\AppData\Local\Temp\~(H)[A[}_FC3OBSP~] S`RV8.gif[/img]">  
                  Options   Indexes   MultiViews           =>           Options   MultiViews            
                  AllowOverride   None  
                  Order   allow,deny  
                  Allow   from   all  
          </Directory>  
   
  Once you remove the Indexes, you won't allow lists.





Previous:Define the php.ini parameters of PHP-FPM in Nginx's CONF
Next:linux to view the commands of the process running under a user
Disclaimer:
All software, programming materials or articles published by Code Farmer Network are only for learning and research purposes; The above content shall not be used for commercial or illegal purposes, otherwise, users shall bear all consequences. The information on this site comes from the Internet, and copyright disputes have nothing to do with this site. You must completely delete the above content from your computer within 24 hours of downloading. If you like the program, please support genuine software, purchase registration, and get better genuine services. If there is any infringement, please contact us by email.

Mail To:help@itsvse.com