Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I had my osCommerce hacked a few moments ago and the morons are using it to send emails. I have identified that they placed scripts inside osCommerce images directory.

Is there a way to forbid certain directories like those containing images from running scripts using .htaccess or something?

Using simply

<Files *.*>
order allow,deny
deny from all
</Files>

on .htaccess is not good because images will not appear on the site.

What can I do beyond applying all osCommerce patches to make it stronger?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I believe you can drop this into an .htaccess where ever you don't want to allow scripts to execute:

<Files *.*>
Options -ExecCGI
</Files>

If you know all the "bad" files are named a certain way you could also disable their being associated to a given handler with this:

<Files *.*>
RemoveHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
</Files>

You can also completely shutdown certain named files with this one from a top level directory:

<Directory full-path-to/dir>
     <FilesMatch "\.(php?|pl|perl)$">  
         Order Deny,Allow
         Deny from All
     </FilesMatch>
 </Directory>

Or you can lock it down based on the actual URL used to get to it:

<LocationMatch "/URL/TO/FILES/.*\.(php?|pl|perl)$">
     Order Deny,Allow
     Deny from All
</LocationMatch>
share|improve this answer
    
thanks. I will try these options. –  SpaceDog Apr 22 '13 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.