You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Lyle Wincentsen <ly...@gmail.com> on 2009/05/24 07:31:44 UTC
[users@httpd] Running php scripts outside of document root
I am new to apache and php, so I suspect this will be an easy one to answer.
In short, I am trying to set up my document root to be /var/www/htdocs
and I want my php scripts to run in /var/www/cgi-bin. For some reason
I am getting "500 internal server error" when I try to run a script
(called phpauth.php) in that directory. If I try to run the same
script in the document root, it works fine but I don't want to do
that.
Here are the relevant lines of the error log:
[Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
(8)Exec format error: exec of '/var/www/cgi-bin/phpauth.php' failed,
referer: http://{myserver.ip.address}
[Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
Premature end of script headers: phpauth.php, referer:
http://{myserver.ip.address}
I am running apache 2.2 on Debian, with the config settings at default
except as shown below.
This is a listing of /etc/apache2/sites-enabled/000-default, which is
a symlink to /etc/apache2/sites-available/default. The only changes
are where I commented out lines and replaced them with the lines
immediately below them.
<VirtualHost *:80>
ServerAdmin webmaster@localhost
# DocumentRoot /var/www
DocumentRoot /var/www/htdocs
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
# <Directory /var/www>
<Directory /var/www/htdocs>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
# ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
ScriptAlias /cgi-bin/ /var/www/cgi-bin/
# <Directory "/usr/lib/cgi-bin">
<Directory "/var/www/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/access.log combined
Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
Options Indexes MultiViews FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
</VirtualHost>
I didn't make any changes in apache2.conf or anywhere else. I just
changed /etc/apache2/sites-available/default as shown above, then I
did apache2ctl stop, a2dissite default, a2ensite default, apache2ctl
start.
Thanks
-Lyle
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Running php scripts outside of document root
Posted by Nicholas Sherlock <n....@gmail.com>.
Lyle Wincentsen wrote:
> Thanks for your help, that solved the problem.
>
> To answer your question as to why I don't want my php scripts to be
> in the document root tree, it is a potential security issue. I would
> rather not allow anyone to peruse my source code as they may be able
> to find ways to exploit it more easily.
Being in the document root does not imply that people will be able to
read your code. If they browse to the file, they'll just see the output
from the script, not the source itself.
Cheers,
Nicholas Sherlock
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Running php scripts outside of document root
Posted by Lyle Wincentsen <ly...@gmail.com>.
Thanks for your help, that solved the problem.
To answer your question as to why I don't want my php scripts to be in the
document root tree, it is a potential security issue. I would rather not
allow anyone to peruse my source code as they may be able to find ways to
exploit it more easily.
On Sun, May 24, 2009 at 12:45 AM, Doug Bell <do...@plainblack.com> wrote:
> On May 24, 2009, at 12:31 AM, Lyle Wincentsen wrote:
>
>
>> In short, I am trying to set up my document root to be /var/www/htdocs and
>> I want my php scripts to run in /var/www/cgi-bin.
>>
>>
>
> Why? You can run PHP scripts in the same directory as your htdocs as you
> want.
I'm thinking it is a potential security issue if they are in the document
root, since people will be able to look at the source code and figure out
how to exploit it. I'd rather it be inaccessible to them.
>
>
For some reason I am getting "500 internal server error" when I try to run
>> a script
>> (called phpauth.php) in that directory. If I try to run the same
>> script in the document root, it works fine but I don't want to do
>> that.
>>
>> Here are the relevant lines of the error log:
>>
>> [Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
>> (8)Exec format error: exec of '/var/www/cgi-bin/phpauth.php' failed,
>> referer: http://{myserver.ip.address}
>> [Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
>> Premature end of script headers: phpauth.php, referer:
>> http://{myserver.ip.address}
>>
>>
>
> Exec format error means your #! line is incorrect. Since you're using
PHP, you're probably not using CGI (which requires the #! line)
I had been under the impression that "CGI" was a generic term that applied
whenever one was using any kind of scripting on the server. I see I need to
read up on that some more. The CGI book I recently read was very dated.
> # ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ ScriptAlias
>> /cgi-bin/ /var/www/cgi-bin/
>>
>>
> Here's the issue. It should be "Alias" not "ScriptAlias". If you intend on
> also running CGI scripts from this directory, add "AddHandler cgi-script
> .cgi" to the <Directory /var/www/cgi-bin> block.
>
> Make sure to enable PHP for that directory as well: AddHandler
> application/x-httpd-php .php
>
> Doug Bell -- Senior Developer, Plain Black Corp.
> [ http://plainblack.com ]
>
> Thanks a lot, I will try that.
> -Lyle
>
>
>
Re: [users@httpd] Running php scripts outside of document root
Posted by Doug Bell <do...@plainblack.com>.
On May 24, 2009, at 12:31 AM, Lyle Wincentsen wrote:
> In short, I am trying to set up my document root to be /var/www/htdocs
> and I want my php scripts to run in /var/www/cgi-bin.
Why? You can run PHP scripts in the same directory as your htdocs as
you want.
> For some reason
> I am getting "500 internal server error" when I try to run a script
> (called phpauth.php) in that directory. If I try to run the same
> script in the document root, it works fine but I don't want to do
> that.
>
> Here are the relevant lines of the error log:
>
> [Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
> (8)Exec format error: exec of '/var/www/cgi-bin/phpauth.php' failed,
> referer: http://{myserver.ip.address}
> [Sat May 23 22:19:02 2009] [error] [client {mylaptop.ip.address}]
> Premature end of script headers: phpauth.php, referer:
> http://{myserver.ip.address}
Exec format error means your #! line is incorrect. Since you're using
PHP, you're probably not using CGI (which requires the #! line)
> # ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
> ScriptAlias /cgi-bin/ /var/www/cgi-bin/
Here's the issue. It should be "Alias" not "ScriptAlias". If you
intend on also running CGI scripts from this directory, add
"AddHandler cgi-script .cgi" to the <Directory /var/www/cgi-bin> block.
Make sure to enable PHP for that directory as well: AddHandler
application/x-httpd-php .php
Doug Bell -- Senior Developer, Plain Black Corp.
[ http://plainblack.com ]
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org