Difference between #16 and #17 of
How to write secure Yii1 applications

Revision #17 has been created by François Gannaz on Oct 30, 2013, 9:18:08 AM with the memo:

Add comments to the Apache VH snippet
« previous (#16) next (#18) »

Changes

Title unchanged

How to write secure Yii applications

Category unchanged

How-tos

Yii version unchanged

Tags unchanged

security, authorization, authentication, XSS, SQL injection

Content changed

[...]
php_admin_flag engine off
Options -Indexes
</Directory>
~~~

Instead of the previous configuration, here is an example of putting a Yii application in a Virtual Host. Each securing directive has an explaining comment. ~~~ [apache] # Example config for Yii-myapp as an Apache VirtualHost # Please set the pathes and the host name to their right values

<VirtualHost *:80>
[...]
<Directory "/home/myapp/www">
AllowOverride NoneOptions +FollowSymLinks
 
# These 2 lines are useless with modern PHP php_flag register_globals Off php_flag gpc_magic_quotes Off # # <IfModule mod_rewrite.c> # # The following block is for masking "index.php" in the url # # We also need toTo enable it, configure the app: urlManager.showScriptName = false # Options +FollowSymLinks
 
# IndexIgnore */* # RewriteEngine on # RewriteCond %{REQUEST_FILENAME} !-f # RewriteCond %{REQUEST_FILENAME} !-d # RewriteRule . index.php # </IfModule> </Directory> # Forbid direct access to this directory
 
 <Directory "/home/myapp/www/protected"> Deny from All </Directory> # protect several non-PHP directories
 
 <DirectoryMatch "/home/myapp/www/(assets">
 
php_admin_flag engine off|css|images|js)$">
 
# Forbid execution of PHP scripts
 
php_admin_flag engine off
 
# Forbid listing of files Options -Indexes </DirectoryMatch>
</VirtualHost>
~~~

### For every PHP project
[...]
80 0
114 followers
Viewed: 315 033 times
Version: 1.1
Category: How-tos
Tags: authentication, authorization, security, SQL injection, XSS
Written by: François Gannaz
Last updated by: François Gannaz
Created on: Nov 22, 2011
Last updated: 3 years ago
Update Article
Revert to #16 | Revert to #17

Revisions

View all history