Topic: file extension .inc to inc.php
If all the *.inc files are renamed to be *.inc.php and the code altered to use such extensions, then the inability to use the .htaccess file would not be a security issue.
Re: file extension .inc to inc.php
I'm not sure what problem you have encountered, but anyway we cannot make such a naming change.
*.inc are library files which should never be considered as executable by www server. Renaming them to *.php will make them vulnerable to RFI attack. Another countermeasure would require including ugly security check in every file (like the one at the top of language.php file).
Janusz
- apmuthu
- Moderator
- Offline
Re: file extension .inc to inc.php
Makes sense. Except that .htaccess files were being maliciously overwritten and the *.inc files got exposed on the browser. Now incorporated the contents of the .htaccess file into the main apache conf file itself and removed the .htaccess file in Debian Squeeze to work as expected.
Thanks. Wikied the info.