• From: Singapore, India, Chennai
  • Registered: 05/02/2009
  • Posts: 6,150

Topic: file extension .inc to inc.php

If all the *.inc files are renamed to be *.inc.php and the code altered to use such extensions, then the inability to use the .htaccess file would not be a security issue.

apmuthu's Website

  • Registered: 12/25/2007
  • Posts: 2,448

Re: file extension .inc to inc.php

I'm not sure what problem you have encountered, but anyway we cannot make such a naming change.
*.inc are library files which should never be considered as executable by www server.  Renaming them to *.php will make them vulnerable to RFI attack. Another countermeasure  would require including ugly security check in every file (like the one at the top of language.php file).

Janusz

  • From: Singapore, India, Chennai
  • Registered: 05/02/2009
  • Posts: 6,150

Re: file extension .inc to inc.php

Makes sense. Except that .htaccess files were being maliciously overwritten and the *.inc files got exposed on the browser. Now incorporated the contents of the .htaccess file into the main apache conf file itself and removed the .htaccess file in Debian Squeeze to work as expected.

Thanks. Wikied the info.

apmuthu's Website