只允许本地主机访问所有包含 php 文件的文件夹
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6264372/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Allowing only localhost to access a folder where all inclusive php files exist
提问by user706087
We all have php files like 'connect_db.php' for include purposes only.
我们都有像 'connect_db.php' 这样的 php 文件，仅用于包含目的。
Suppose I have all those inclusive .php files in "www/html/INC"
假设我在“www/html/INC”中有所有包含的 .php 文件
And I have index.php
我有 index.php
I want index.php accessible from browser to everyone, but I want to prevent users' direct access to "www/html/INC" folder. (e.g. when type in the browser 'www.domain.com/INC/' -> 404 error etc)
我希望每个人都可以从浏览器访问 index.php，但我想阻止用户直接访问“www/html/INC”文件夹。（例如，当在浏览器中输入“www.domain.com/INC/”时 -> 404 错误等）
How do I achieve this?
我如何实现这一目标？
Preferrably using .htaccess file in the root directory please.
最好在根目录中使用 .htaccess 文件。
采纳答案by Berry Langerak
How do I achieve this?
我如何实现这一目标？
Don't. As per my previous answer, it's much more secure to put connect_db.php in /www/, not in /www/html/INC/. If you aregoing to do so, then you'd use /www/html/.htaccess:
别。根据我之前的回答，将 connect_db.php 放在 /www/ 而不是 /www/html/INC/ 中要安全得多。如果你正在打算这么做，那么你会使用/www/html/.htaccess：
<Directory "/www/html/INC">
order allow,deny
deny from all
</Directory>
回答by Shadikka
Something like
就像是
<Directory /INC>
Order deny,allow
Deny from all
Allow from 127.0.0.1
</Directory>
should work.
应该管用。
回答by nickell
Google searches have brought me here so I figured I'd post what I found in the apache docstoday. I'm not positive what versions of apache it is available in, but do a search for your version to verify.
谷歌搜索把我带到了这里，所以我想我会发布我今天在apache 文档中找到的内容。我不确定它在哪些 apache 版本中可用，但请搜索您的版本以进行验证。
Now you can just use Require local. I'd recommend putting an .htaccess in the folder that you want to restrict access to with just that line. However, if you must do it in the root directory then here's what it would be:
现在你可以使用Require local. 我建议将 .htaccess 放在您想要仅使用该行限制访问的文件夹中。但是，如果您必须在根目录中执行此操作，那么它会是这样：
<Directory "www/html/INC">
Require local
</Directory>
回答by Domi
回答by OZ_
Move connect_db.phpto the more high level in directories tree, than public directory.
And all scripts, which should not be executable - too.
移动connect_db.php到目录树中比公共目录更高的级别。
以及所有不应可执行的脚本 - 也是。
/home/user/project/incs/-- here your inclusive scripts/home/user/project/www/html-- here your index.phpand other executable scripts.
/home/user/project/incs/-- 这里是您的包含脚本/home/user/project/www/html-- 这里是您的index.php和其他可执行脚本。
