Hello,
I have a directory tree for my project:
/www/CMS/
/www/CMS/files/
/www/CMS/files/Images
/www/CMS/files/Documents
The user is able to access content and subfolders files/ via FTP, which is the place for his stuff
My question is, how can I prevent running php scripts in files/ , files/Images/ , files/Documents/ using .htaccess
because I tried run a <?php echo get_file_contets("../../index.php"); ?> in /www/CMS/files/Images/ and it displayed my code;
I have a .htaccess file:
RemoveHandler .php .phtml .php3 .php5
RemoveType .php .phtml .php3 .php5
php_flag engine off
but if place it in /www/CMS/ it stops running my project; if I place it in /www/CMS/files/ , the htaccess can be simply deleted by user via ftp
thank you for any help