disable access to included files

Question

i have a litte question..

i want to disable the direct access to my included files. (example header.tpl.php, footer.tpl.php, confic.inc.php, db-connect.inc.php ect.)

but first let me explain what i wanna do i want to all allow the access for my included files (index.php) and disable the files with a 404 header for direct access.

now i found some cool php snippet and modified it (404 header and 404 include)

in my index.php is this code:

define('MY_APP',true);

in my templatefiles is this code:

if(!defined('MY_APP')) {
header('HTTP/1.1 404 Not Found');
include('./../error/404.php');  
die; }

do you see any security or other problems with this code?

best regards bernte

Answer 1

do you see any security or other problems with this code?

In case your server is re-configured so that the .php don't get executed any longer, their source-code will be viewable.

But next to that your approach is a quite common way to do that. However error/404.php could contain the header('HTTP/1.1 404 Not Found'); line so you don't need to repeat it for each file. Same for the die; statement.

In each library/template etc. file:

require('../error/include_file.php');

In include_file.php:

if(!defined('MY_APP'))
{
    header('HTTP/1.1 404 Not Found');
    include('404.php');  
    die; 
}

Is maybe better for your design. Don't repeat yourself that much.

Answer 2

if (basename($_SERVER['SCRIPT_FILENAME']) == basename(__FILE__))
{
    //header("Location: index.php");
    exit("NOT ALLOWED");
}

Answer 3

Why not just tuck it above the public_html folder or whatever you use as the default html folder and include with ../../. Then it would be available to scripts but the public would get a default 404/ file not found. I do this with config files that hold passwords and such so no one public can access them.