Home

Cache or PHP-info is none of your business

Sat, 24/02/2007 - 08:41 — Heine

I've a few extra scripts in the webroot of several sites to provide me with server information when I need it. These scripts tend to provide too much information to just anyone. Here's how you can quickly limit access to the Drupal admin user (the first user created on the site).

Create a file restrict.php. The example assumes all files (restrict.php, info.php and apc.php) are in the Drupal root directory. You need to adapt the include paths if you save the files elsewhere. You can make the access criteria as baroque as you need; the example simply checks on user id.

  1. // restrict.php
  2. // Check whether the users is the Drupal admin user.  Display an access denied page and exit if not.
  3. require_once("./includes/bootstrap.inc");
  4. drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
  5. if ($user->uid != 1) {
  6.   drupal_maintenance_theme();
  7.   drupal_set_title('Access denied');
  8.   print theme('maintenance_page', '<p>Access denied. You are not authorized to access this page.</p>');
  9.   exit();
  10. }

You can, by simply including restrict.php, limit access to phpinfo ...

  1. // Restrict access to info.php
  2. require_once('./restrict.php');

... or apc.php.

  1. // ...
  2. # Tie in to Drupal access control.
  3. # Prevent non-uid 1 users from accessing this page.
  4. require_once('./restrict.php');
  5.  
  6. $VERSION='$Id: apc.php,v 3.51 2005/04/02 02:07:41 rasmus Exp $';
  7. //...

No votes yet

Comments

Sat, 21/04/2007 - 23:32 — Anonymous (not verified)

I think

don't you need global $user; at the beginning?

Thu, 03/05/2007 - 13:58 — Heine

Scope

No, as we're mucking in the global scope, $user is already available.

Sat, 05/04/2008 - 16:38 — bertboerland (not verified)

changelog

so we obfuscate HTTP headers on d.o (just apache and php, no version information) and we hide phpinfo. but having a CHANGELOG.txt in the docroot is no bad? I dont get it Heine, and yes this s one of the 100 things I dont agree with "the rest" but learned to deal with it :)