如何保护LAMP服务器中的文件？

Question

我用PhP制作了一个联系人表格，将用户的电子邮件发送到"email.txt"-document。唯一的问题是，任何人都可以在URL "example.com/email.txt“中看到文档。

我的PHP代码如下所示：

<!DOCTYPE html>
<html>
    <head></head>
    <body>
        <?PHP
        $email = $_POST["emailaddress"];

        $to = "email@example.com";
        $subject = "New Email Address for Mailing List";
        $headers = "From: $email\n";

        $message = "A visitor to your site has sent the following email address to be added to your mailing list.\n

        Email Address: $email";

        $user = "$email";
        $usersubject = "Thank You";
        $userheaders = "From: email@example.com\n";

        $usermessage = "Thank you for subscribing to our mailing list.";

        mail($to,$subject,$message,$headers);

        mail($user,$usersubject,$usermessage,$userheaders);

        $fh = fopen("email.txt", "a");
        fwrite($fh, $email);
        fclose($fh);

        ?>

        <html>
            <body>
                <table width="400" border="0" cellspacing="0" cellpadding="0">
                    <tr>
                        <td>
                            <div align="center">Thank You, Your Information Has Been Submitted</div>
                        </td>
                    </tr>
                </table>
            </body>
        </html>
    </body>
</html>

现在有谁能保护这份文件？

Answer 1

移动该文件，以便它存在于服务器根目录之外的目录中。

例如，我的服务器的目录结构如下所示：

/hosts/example.com/apache  # For server configuration files
/hosts/example.com/pages   # For normal files to be served
/hosts/example.com/data    # For data files (like the one you are talking about)
/hosts/example.com/logs    # For log files
/hosts/example.com/stats   # For reports generated from log files

或者(但增加了复杂性)，使用RDBMS代替。

或者(但是如果配置失败的话会有更大的安全问题)，配置服务器来具体地拒绝对该文件的访问。例如，使用Apache中的<Files>块和允许/拒绝指令。