Come for the quick hacks, stay for the epiphanies. | |
PerlMonks |
Re^7: Using relative paths with taint modeby afoken (Chancellor) |
on Jun 24, 2021 at 07:55 UTC ( [id://11134247]=note: print w/replies, xml ) | Need Help?? |
(See also Re^5: Using relative paths with taint mode and Re^7: Using relative paths with taint mode)
That should be sufficient to get any number of protected directories that are not reachable via HTTP(S), without messing with .htaccess files: Given that only very few characters are allowed in host and domain names (only ASCII letters, ASCII digits, and the hypen are allowed for any subdomain, and the dot separates subdomains), it is trivial to create a directory below /home/myusername/ that is NOT a valid domain name, e.g. _lib or !private. (Note that all Internationalized domain names use Punycode to encode Unicode to that restricted set of characters.) Even without shell and FTP access, you seem to be able to modify cPanel, and cPanel can create directories. So you can modify cPanel to create the directories. Now you can create directories unreachable for HTTP(S) clients where you can store modules, configuration and database files. Of course, depending on the actual webserver configuration, it may be possible to manually issue an HTTP request with an invalid hostname after using a valid hostname to resolve the IP address of the server. So to be paranoid, put a .htaccess file in those protected directories that prohibits all access. It won't affect the normal webserver use at all, it is just a last resort. Alexander
-- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
In Section
Seekers of Perl Wisdom
|
|