Question

Im working on an upload script, and i want a user to be able to upload any file.
I had it al working on localhost, i added

    php_flag engine off 
    AddType text/plain php html shtml php5 php4 php3 cgi asp aspx xml

to my htaccess in the upload folder, and it showed the source of PHP, html and all other files. Exactly as i wanted to.
Now i tried to upload it to a real webserver, and unfortunately my host does not allow such .htaccess files.

I tried openinging the files with file_get_content() and fopen() and giving them a text/plain header.. but nothing works. It first executes the scripts and shows the output in my textarea.

Do you guys have any suggestions on how i can fix this without .htaccess ?

Thanks!

Answer 1

Don’t upload files into the webroot and let people access them directly. As you say, .php scripts (and probably a lot more) get executed that way. A classic way for arbitrary code execution attacks.

Store uploaded files outside the webroot where they’re not publicly accessible and create a script that allows users to download the files, for example using readfile or Apache mod_xsendfile, after having done the necessary permission checks.

Also see Security threats with uploads.