I'm no web host manager or anythin of the sort, I'm simply a programmer but I have reason to believe the webhost I'm using is badly configured and I need help on how to tell the guy who hosts it how to fix it.


Basically, an example is this:


I have 2 directories...


public_html/server (CHMOD is 755 which is default)
public_html/server/logs (CHMOD is 755 which is default)


In public_html/server I have a file called 'admin.php.' When an admin logs into the script in 'admin.php' a log of the event is written to public_html/server/logs/adminlog.txt.


I don't want public users, however, to be able to access adminlog.txt so I CHMOD adminlog.txt and remove the 'execute' attribute for public users (this is right, yes?). However, it does absolutely nothing. The file is still accessible from the public domain. If I remove the read/write attributes for public users then 'admin.php' is no longer able to write to it.


This makes me think that the webhost thinks that the php files have public access, rather than 'group' access or 'owner' access?


If I CHMOD the 'logs' directory and remove the 'execute' attribute, even if adminlog.txt has all attributes turned on then 'admin.php' is still unable to write to the file.


Any ideas on what's wrong and how to fix it?

I fail to understand what you think the problem is.

admin.php is password protected, isn't it? If not you have a bad script. And, this is the issue you should be addressing. If any referrer other than admin.php can acess the log file you also have a script problem.

Yes different servers are configged differently. The chances of a host changing the config to what you think is correct is pretty near -50.

Originally Posted by colbyt

I fail to understand what you think the problem is.

admin.php is password protected, isn't it? If not you have a bad script. And, this is the issue you should be addressing. If any referrer other than admin.php can acess the log file you also have a script problem.

Yes different servers are configged differently. The chances of a host changing the config to what you think is correct is pretty near -50.

I don't really follow what you mean by "password protected" in terms of admin.php.

Admin.php is accessible via HTTP, and you login with a username/password, which then takes you to the admin panel (still using admin.php). Once logged in, the admin.php then creates logs/adminlog.txt and writes something like "John logged in at <date and time here>."

And obviously I don't want people being able to see the contents of adminlog.txt from HTTP.

I configured it correctly with my old server, by taking off the 'execute' attribute for public users, but that simply doesn't work on the new server.