Anyone know if it's possible to disable scripts in certain directories - so if a .php, .cgi or something else is requested it won't be treated like a script, but like any other file..?

Thanks

Well what you would have to do is put the files onto another server and then turn off PHP support.

Otherwise, you could just save all of the scripts as TXT files...

Originally Posted by coolkbk585

Well what you would have to do is put the files onto another server and then turn off PHP support.

That is not an option...

Otherwise, you could just save all of the scripts as TXT files...

That too is not an option This is a folder where users can upload files.. Of course, .php files and similar is filtered out - this will be only for extra security.

Before you let them upload it you can also run it through a script that str_replaces all of the <?php tags...making all of the code harmless.

But all of the code would show up as text.

What do you mean by "disable scripts" ?

Redirecting to another page, displaying a specific message, generating a blank page, resulting in a "403 access denied", or not being parsed (meaning displaying the php source in the browser) ?

Originally Posted by tripy

What do you mean by "disable scripts" ?

Redirecting to another page, displaying a specific message, generating a blank page, resulting in a "403 access denied", or not being parsed (meaning displaying the php source in the browser) ?

The last, not being parsed.

As far as I know, this must be handled in PHP.
If you disable the handler on PHP script in apache, it will be served as html, with the php code in text into the document.

You must save in some place which directory you want to disable, and have every php pages on your site to check this list to see if they are allowed to be parsed.
If not, simply do an exit(); otherwise do the parsing as previously.