Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had my osCommerce hacked a few moments ago and the morons are using it to send emails. I have identified that they placed scripts inside osCommerce images directory.

Is there a way to forbid certain directories like those containing images from running scripts using .htaccess or something?

Using simply

<Files *.*>
order allow,deny
deny from all

on .htaccess is not good because images will not appear on the site.

What can I do beyond applying all osCommerce patches to make it stronger?

share|improve this question
up vote 2 down vote accepted

I believe you can drop this into an .htaccess where ever you don't want to allow scripts to execute:

<Files *.*>
Options -ExecCGI

If you know all the "bad" files are named a certain way you could also disable their being associated to a given handler with this:

<Files *.*>
RemoveHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi

You can also completely shutdown certain named files with this one from a top level directory:

<Directory full-path-to/dir>
     <FilesMatch "\.(php?|pl|perl)$">  
         Order Deny,Allow
         Deny from All

Or you can lock it down based on the actual URL used to get to it:

<LocationMatch "/URL/TO/FILES/.*\.(php?|pl|perl)$">
     Order Deny,Allow
     Deny from All
share|improve this answer
thanks. I will try these options. – SpaceDog Apr 22 '13 at 17:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.