Question

I have a PHP script that I don’t want anyone to be able to run through their browser.

It sends emails and is called via curl by my server’s cron, yet needs to be in the public www directory. What permissions or owner do I need to set the file to to allow only my server’s curl to execute (or do I mean read) the file?

I’m on centos.

Thanks!

Answer 1

You could either limit access to the files by placing a .htaccess file with appropriate access limitations in the directory or by implementing a basic password check at the beginning of your php file like this:

<?php
$password = $_GET['password'];
hash = '40bd001563085fc35165329ea1ff5c5ecbdbbeef'; //precalculated sha1 hash of your password
if (sha1($password) != $hash) {
    die('Forget it!');
}

For added security this could be further refined, but you get the idea …