Welcome, Guest. Please Login or Register.
August 29, 2025, 03:22:43 PM
Home Help Search Log in Register
News: If you are still using YaBB SE, please consider upgrading to SMF as soon as possible.

YaBB SE Community  |  English User Help  |  English Help  |  How can I make my attachments directory NOT world readable and still work? « previous next »
Pages: [1] Reply Ignore Print
Author Topic: How can I make my attachments directory NOT world readable and still work?  (Read 311 times)
Evil-Eddy
Noobie
*
Posts: 26


Blah!
How can I make my attachments directory NOT world readable and still work?
« on: April 17, 2002, 10:24:51 PM »		 Reply with quote
One of my boards has a large amount of files in it.  Some of them are only for certain membergroups.  However, since the entire attachment directory can be read due to the chmod 777, anyone can get access to the entire list of attachments by simply going to www.mydomain/yabbse/attachments.

Is there a way I can prevent this from happenning?

Thanks!
-Evil-Eddy
Logged
mediman
Support Team
YaBB God
*****
Posts: 2858


WWW
Re:How can I make my attachments directory NOT world readable and still work?
« Reply #1 on: April 17, 2002, 10:46:15 PM »		 Reply with quote
sorry but the lists of files has nothing to do with worldwritable!

what you means is directory browsing!

put a .htaccess in your folder with

Code Select
Options -Indexes
medi
Logged
mainComm Dev Team
Evil-Eddy
Noobie
*
Posts: 26


Blah!
Re:How can I make my attachments directory NOT world readable and still work?
« Reply #2 on: April 17, 2002, 11:39:02 PM »		 Reply with quote
Hello mediman,
Well that fixed the indexing, but it also stopped all files from being downloadable in that directory.  Now none of the files can be downloaded there.  I removed it for now.

Any other suggestions?

I'm using freebsd4.3x.

Thanks,
Evil-Eddy
Logged
mediman
Support Team
YaBB God
*****
Posts: 2858


WWW
Re:How can I make my attachments directory NOT world readable and still work?
« Reply #3 on: April 17, 2002, 11:54:25 PM »		 Reply with quote
you can put an blank index file in this directory index.php or index.html and then you can put an .htaccess where you restrictet the access!
Logged
mainComm Dev Team
mediman
Support Team
YaBB God
*****
Posts: 2858


WWW
Re:How can I make my attachments directory NOT world readable and still work?
« Reply #4 on: April 17, 2002, 11:58:36 PM »		 Reply with quote
but an index.php with this content

Code Select
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>401 Authorization Required</TITLE>
</HEAD><BODY>
<H1>Authorization Required</H1>
This server could not verify that you
are authorized to access the document
requested.<p>
Your IP: 
<?php     if ($HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"] !=""){        $IP = $HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"];        $proxy = $HTTP_SERVER_VARS["REMOTE_ADDR"];        $host =@gethostbyaddr($HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"]);    }else{        $IP = $HTTP_SERVER_VARS["REMOTE_ADDR"];        $host =@gethostbyaddr($HTTP_SERVER_VARS["REMOTE_ADDR"]);    }   echo "<font color='red'>$IP</font> with <font color='red'>$host</font> ";   ?>

was saved!<p> Thank you very much :)!
</BODY></HTML>

is enough i think! >:D
« Last Edit: April 17, 2002, 11:59:35 PM by mediman » Logged
mainComm Dev Team
Evil-Eddy
Noobie
*
Posts: 26


Blah!
Re:How can I make my attachments directory NOT world readable and still work?
« Reply #5 on: April 18, 2002, 02:55:13 AM »		 Reply with quote
Excellent solution mediman!!!!  I should have used my head and thought of this myself (duh), but thanks so much for pointing out the obvious.

I think this should be added to the next yabb update so other people short on brain power at any given time will also have some protection over indexing of their dir's.  I know this is server dependant and many don't even allow this to happen in the first place, but for those like me, it would be quite helpfulllllllllllll......


Thanks again Mediman!
-Evil-Eddy
Logged
Pages: [1] Reply Ignore Print 
YaBB SE Community  |  English User Help  |  English Help  |  How can I make my attachments directory NOT world readable and still work? « previous - next »
 


Powered by MySQL Powered by PHP YaBB SE Community | Powered by YaBB SE
© 2001-2003, YaBB SE Dev Team. All Rights Reserved.
SMF 2.1.4 © 2023, Simple Machines
 Valid XHTML 1.0! Valid CSS

Page created in 0.011 seconds with 17 queries.