up vote 0 down vote favorite
share [g+] share [fb]

How can I prevent direct access to my /css and /scripts folders, and there contents? Also, is there a way I can prevent direct access to index.php? (The right way is to just go to my website, which automatically loads the home page through index.php, or go to the specific page with website.com/thepage, which goes to index.php?page=thepage. None of my links directly go to index.php.)

Thanks!

link|improve this question
95% accept rate
What exactly do you mean when you say "direct access"? And why do you want to prevent that? – innaM Oct 25 '09 at 21:19
By directly access I mean just entering in the URL and viewing it, when it's only meant to be used e.g. to style the page. – Mk12 Oct 25 '09 at 21:21
And for things like php files that send an email from a form, I don't want users directly going to that url, it would cause an error. – Mk12 Oct 25 '09 at 21:22
Just how often do you get users entering random URLs in your domain, and complaining when they get errors, or "gibberish" which is actually CSS? – grawity Oct 26 '09 at 13:53
website.com/send isn't that 'random', but anyway I'm doing it a different way now. – Mk12 Oct 26 '09 at 18:10
feedback

2 Answers

up vote 3 down vote accepted

I'm not a web development guy, but from what I understand the following are true:

  • Loading your index.php in a browser spits out the page code that the browser receives and renders. So the browser requests:

    http://website.com/index.php

  • The page code it gets includes certain CSS and Javascript files from your css/ and script/ directories. So the browser requests:

    http://website.com/css/mystyle.css
http://website.com/script/myscript.js

  • In order to include these files, the browser must request those URLs from your webserver, and your webserver must serve them from those URLs.

If so, then no, you can't do what you're asking without changing how your CSS and script files are included.

You could change the PHP, so that it's output doesn't include links to external files, but rather includes the content of those files as inline sections of the PHP output. Then you can use the webserver's standard access controls to disallow access to the css/ and script/ directories.

link|improve this answer
Ok maybe I shouldn't really bother with it it then.. – Mk12 Oct 25 '09 at 22:00
feedback
up vote 1 down vote

You can turn off directory browsing and then people will not be able to see the contents of folders which do not have a default document defined. Is this what you're looking for?

link|improve this answer
Well thats already impossible since website.com/css won't list the directory, it will try to do index.php?page=css (and then redirect to error page). But website.com/css/style.css will display it in plain text. – Mk12 Oct 25 '09 at 20:56
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.