My site was recently infected and running malicious scripts. Once I discovered this, I cleared everything, the hosting company re-initialized the VPS and I setup my site anew. This is how I run my PHP scripts currently. I have two objectives:
- To keep my scripts from being directly accessible from the web
- To never run a script that I do not approve of
First I moved the PHP files out of the public folder except for one gateway file
scripts/ prepend.php a.php b.php ... public_html/ gateway.php html, css, js, image files
I use .htaccess to redirect all requests for my PHP scripts to
gateway.php. This is the file that actually executes the PHP script requested. To reach
a.php, the browser requests
RewriteEngine On RewriteBase / RewriteRule ^php/(.*) gateway.php?file=$1.php [END,QSA,NC]
php.ini, I set
auto_prepend_file to point to
scripts/prepend.php. This file is run before all PHP scripts, so I can use it to do some configuration. In part, it has a list of allowed PHP scripts.
//the only scripts that will be allowed to run Const SAFE_SCRIPTS = '"path/to/gateway.php","/path/to/a.php","/path/to/b.php"'; Const SCRIPTS_PATH = __DIR__; //ensure that the requested script is allowed. The check here is to prevent //a maliciously uploaded PHP file from executing. $file = $_SERVER['SCRIPT_FILENAME'];//typically /path/to/gateway.php if(strpos(SAFE_SCRIPTS,"\"$file\"")===false) die("$file is not allowed");
prepend.php, gateway.php runs; it's in charge of making sure the requested PHP file is on the allowed list and for forwarding the request to the right file
//get the file requested. Comes from the htaccess rule $file = SCRIPTS_PATH.'/'.$_GET['file']; //if file is not in the allowed list, abort. The check here is to prevent //gateway from loading any file it wasn't designed to load if(strpos(SAFE_SCRIPTS,"\"$file\"")===false) die("$file is not allowed"); //load the file that actually handles the http request require $file;
Looking for feedback on what's the weakest link and/or how to improve.