Security: clarification of .htacess files within folders that contain a blank index

[dharma]

Concerning Item #7 in the ZC Install Security Docs:

Suggested content for .htaccess files in folders where there is an index.html file but not yet an .htaccess file would be something like the following (depends on your server configuration):

#.htaccess to prevent unauthorized directory browsing or access to .php files
  IndexIgnore */*
  <Files *.php>
   Order Deny,Allow
   Deny from all
  </Files>

 #add the following to protect against people discovering what version your spiders.txt file is
  <Files *.txt>
   Order Deny,Allow
   Deny from all
  </Files>

1. do I use both codes above in one .htacess file?

2. My server will allow .htacess files to be used, but there are quite a lot of folders with blank index files in the ZC file set, do I place them in all folders that have php files?

3. I have yet to enable "Do Not Show Directory Indexes" from my hosts control panel, do I turn that one too? in addition to above?

[DrByte]

1. Yes
2. The settings in a .htaccess file are inherited by folders "below" the one where the .htaccess exists. Thus, you only need it at the "top" of a set of folders you want to protect.
3. That's up to you. Most often 'yes' would be the suggested answer.

[dharma]

Thank you for your reply, so

.htaccess file are inherited by folders "below" the one where the .htaccess exists.

could I just put one htacess file(with the above codes) on my www root, where my entire ZC file set exists?

or is better to put this file just inside each subfolder to protect the files below each folder:

admin
includes
images
editors
extras
email
etc...

I notice there is a .htacess files already in the "includes" folder, which uses the top code (but not the bottom on about spiders) do I have to be concerned about conflicts?

Thanks again for your help in this matter

[Website Rob]

I noticed you continually spell htacess when it should be htaccess. Just wanted to point that out in case you were not aware of it. And, although your Hosting account probably requires the file name to start with a period (.htaccess), the period is not needed when discussing that file.

As to your questions, best to leave the default htaccess files where they are. Good Server security would already have it so that Directory Indexing is not allowed. You can test this using the URL for your Zen Cart install and to the 'images' directory: http://yourdomain.com/images/

If you see your images and/or image names, Directory Indexing has been enabled -- not good. To change that edit the htaccess file in your 'root' directory to add this code: OPTIONS -Indexes

Your 'root' directory shows the directories you mentioned above.

admin
includes
images
editors
extras
email
etc...

[dharma]

I think this is where I got confused from Item#7 of the Security Docs/wiki:

There are also some semi-"blank" index.html files in several folders. These files are there to protect you in case your FTP software won't upload .htaccess files, or your server won't accept them. These only prevent directory browsing, and do not stop execution of .PHP files. It's a good "alternative", although using .htaess files in ALL of these folders is the better choice, for servers that accept them.

Since all the .htaccess were uploaded successfully to my server from the original ZC install and I now know that one .htaccess file affects all folders below it...I do not need to create any addtional .htacess files?

If that is the case, and I do not need to supplement the .htacess files to include

 <Files *.txt>
   Order Deny,Allow
   Deny from all
  </Files>

great! It looks like all the Top ZC folders that contain php scripts have a .htaccess file in it except the "extras" folder.

I guess I place one in there? and in some other folders which contain php scripts but are not related to ZC.

[dharma]

Sorry to go on about this, I just want to get it right.

Leaving all the .htaccess files where they are, I added this bit to the includes/htaccess:

 <Files *.txt>
   Order Deny,Allow
   Deny from all
  </Files>

so this file, is now:

# $Id: .htaccess 1105 2005-04-04 22:05:35Z birdbrain $
#
# This is used with Apache WebServers
# The following blocks direct HTTP requests in this directory recursively
#
# For this to work, you must include the parameter 'Limit' to the AllowOverride configuration
#
# Example:
#
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit
#
# 'All' with also work. (This configuration is in your apache/conf/httpd.conf file)
#
# This does not affect PHP include/require functions
#
# Example: http://server/catalog/includes/application_top.php will not work

<Files *.php>
Order Deny,Allow
Deny from all
</Files>

#add the following to protect against people finding your spiders.txt version 
<Files *.txt>
Order Deny,Allow 
Deny from all 
</Files>

I have copied this includes/.htaccess file and put it in other root folders like "extras" that contain php scripts, but no .htaccess file.

But, the admin folder has a differenet .htaccess file:

# $Id: .htaccess 1105 2005-04-04 22:05:35Z birdbrain $
#
# This is used with Apache WebServers
#
# For this to work, you must include the parameter 'Options' to
# the AllowOverride configuration
#
# Example:
#
# <Directory "/usr/local/apache/htdocs">
#   AllowOverride Options
# </Directory>
#
# 'All' with also work. (This configuration is in the
# apache/conf/httpd.conf file)

# The following makes adjustments to the SSL protocol for Internet
# Explorer browsers

<IfModule mod_setenvif.c>
  <IfDefine SSL>
    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
  </IfDefine>
</IfModule>

# Fix certain PHP values

#<IfModule mod_php4.c>
#  php_value session.use_trans_sid 0
#  php_value register_globals 1
#</IfModule>

# to turn off register_globals
# php_value register_globals 0

Should I supplement the admin/.htaccess file with the following code as well?

#.htaccess to prevent unauthorized directory browsing or access to .php files 
   IndexIgnore */*
   <Files *.php>
    Order Deny,Allow
    Deny from all
   </Files> 

#add the following to protect against people finding your spiders.txt version 
   <Files *.txt>
    Order Deny,Allow 
    Deny from all 
   </Files>

or leave alone?

[Website Rob]

Your 'includes/.htaccess' file looks good.

I have copied this includes/.htaccess file and put it in other root folders like "extras" that contain php scripts, but no .htaccess file.

You do not need to do that. Remember what was mentioned earlier:
The settings in a .htaccess file are inherited by folders "below" the one where the .htaccess exists. Thus, you only need it at the "top" of a set of folders you want to protect.


If you use this code in your 'admin/.htaccess' file:

<Files *.php>
Order Deny,Allow
Deny from all
</Files>

you will lock yourself out, along with everybody else.

Understand that when "Deny from all" is stated, it means exactly that. That is why the 'admin/includes/.htaccess' file also includes this statement:

Allow from localhost

Which means when accessing from the Admin section, you will not run into any problems with using the Admin section.