Preventing scripts being executed from writeable directories

Is it possible with Apache to prevent (for example) mod_php parsing
any scripts which reside in writeable directories?

I'm dealing with the aftermath of an exploit which made use of a code
flaw to upload a script to a writeable directory (intended for
uploading images), then running that script through its URL. The
ability of that exploit to cause any damage would have been reduced
if .php files were only parsed from read-only directories.

On 3 Oct, 18:11, moresoluti...@gmail.com wrote:
> Is it possible with Apache to prevent (for example) mod_php parsing
> any scripts which reside in writeable directories?
>
> I'm dealing with the aftermath of an exploit which made use of a code
> flaw to upload a script to a writeable directory (intended for
> uploading images), then running that script through its URL. The
> ability of that exploit to cause any damage would have been reduced
> if .php files were only parsed from read-only directories.

Yes - switch off the handler with a <Directory> or <location> tag in
your Apache config or use a .htaccess file in the directory:

AddType text/plain .php .phtml

C.