Security Update to SimpleSite 07/08

I have had a concern brought to me that using .inc files is a security issue, people can access the xxx.inc file directly and read the full file contents.

While I agree, this can be fixed with a rule in your .htaccess file that will send a 403 Forbidden response to all requests .inc files. I personally like using .inc file extensions for include files rather than .php as there files do not and should not be run directly. To use .php over .inc this section explains what to change.

Download an update from the main SimpleSite post ~ http://sheldon.lendrum.co.nz/building-a-completely-dynamic-site-using-text-files-php-and-no-mysql_187/03/

Modifying your .htaccess file

Add these lines in your .htaccess file in your root html directory were SimpleSite is installed

# Block Reading of *.inc files

order allow,deny
deny from all

To Customise your 403 Forbidden page you can use this in your .htaccess file

# Set Error Documents.
ErrorDocument 403 /forbidden.html
ErrorDocument 404 /notFound.html
ErrorDocument 500 /serverError.html

Another Security Idea would be to make sure that your server will not allow directory listings, this will happen on some servers where there is no default file in the directory, e.g. no ‘index.html|.htm|.php|.shtml’etc..

#  Block Dir Listing
Options All -Indexes

Using .php file Extensions over .inc

If you would rather use a .php file extension (or for that matter any file extension ) in your included files. rename the .inc files to your chosen ext and then open the

includes/simplesite.php

file and edit your $config array to look for your new file ext.

"fileExt"     => ".php",

	function config() {
		$config = array(
			"siteName"    => "Dynamic File Based Site",           // 'siteName'    -> TITLE OF THE SITE,  USED FOR COSMETIC PURPOSES MOSTLY.
			"httpHost"    => "http://{$_SERVER['HTTP_HOST']}/",   // 'httpHost'    -> HTTP PATH 'http://sheldon.lendrum.co.nz'
			"docRoot"     => "{$_SERVER['DOCUMENT_ROOT']}/",      // 'docRoot'     -> FULL DOCUMENT ROOT PATH.
			"filePath"    => "pages/",                            // 'filePath'    -> DIRECTORY OF PAGE FILES.
			"fileExt"     => ".php",                              // 'fileExt'     -> INCLUDES FILE EXT.
			"request"     => "page",                              // 'request'     -> USED IN $_GET[],  IF USING MOD REWRITE,  ALTER RULE TO MATCH.
			"newLine"     => "\n",                                // 'newLine'     -> FORMATING NEW LINE, OPTIONS: (empty), "\n",  "\r\n"
			"styleSheet"  => "styles/format.css",                 // 'styleSheet   -> PATH TO STYLESHEET,  USED WITH 'httpHost'
			"defaultPage" => "home",                              // 'defaultPage' -> DEFAULT FILE WITH NO PAHT OR EXTENSION TO BE INCLUDED.
			"modReWrite"  => "off"                                // 'modReWrite'  -> IF YOU WANT TO USE MOD REWRITE TO HAVE 'PRETTY URLS',  SET THIS TO ON,
			);                                                    // CREATE YOUR '.htaccess' AND ADD THE RULES FROM THE 'help-file' PAGE.
		return $config;                                           // THE NAVIGATION WILL AUTOMATICALLY WRITE THE CORRECT URLS DEPENDING ON YOUR SELECTION.
	}