Member Avatar for vedro-compota

Hi there))

Guys please tell me - how to make reference to directory which is on higher level that site root (by php - site is on local machine) -
may by this situation need some aliases in apache .conf file?
As I see the server(apache) don't want to understand path like "..\scripts"....
what should i do?

big thanks in advance))

  • 3 Contributors
  • 4 Replies
  • 203 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by vedro-compota

Dani AI

Generated

asked whether a browser can directly open files that live above the site root. demonstrated a server-side read and correctly explained why the browser route is blocked. The essential point: PHP (server-side) can access any filesystem path the PHP process has permission for, but an HTTP client can only request URLs the web server maps to — normally that mapping is confined to DocumentRoot or explicit virtual paths (Alias, vhost).

For safe server-side use (recommended): keep sensitive scripts/config outside the webroot and load them from PHP with an absolute filesystem path. Build paths with __DIR__, dirname(__FILE__) or realpath() so includes remain robust when files move. Example pattern:

<?php
require_once __DIR__ . '/../shared/config.php';
?>

This keeps code private while still available to your PHP application.

If the goal is to let the browser GET files outside DocumentRoot, make that explicit in the web server instead of relying on “..” in URLs. On Apache add an Alias or adjust the VirtualHost so the external folder is mapped to a URL path, then set an appropriate <Directory> policy and restart Apache. Example Apache config (Apache 2.4 style):

Alias /external "C:/path/outside/webroot"
<Directory "C:/path/outside/webroot">
    Require all granted
    Options -Indexes
</Directory>

Security cautions: avoid exposing whole system folders, backups, .env or .git; restrict by IP or use <FilesMatch> to limit served file types; prefer a small PHP controller that validates requests and streams files rather than exposing a raw directory. If using symlinks, enable FollowSymLinks and confirm Apache and filesystem permissions allow the target to be read by the webserver. Check error logs and phpinfo() while troubleshooting.

Recommended Answers

All 4 Replies

Member Avatar for Member #120589

I don't understand why you can't access them.

This is an example of me accessing a file in the computer's root directory (c:\) from localhost (C:\xampp\htdocs\mysite\ folder).

echo file_get_contents('../../text.txt');
Edited by Member #120589 because: n/a
commented: +++++++++++ +3
Member Avatar for vedro-compota

thanks for answer))

echo file_get_contents('../../text.txt');

yes)) this variant work in my case too )) - I also have access to all directories , but what about to load page - some file.php from (c:\) (when site root as in your example is on C:\xampp\htdocs\mysite\ folder )
what path you'll see in browser?

to be more concrete - i need to make reference , from (for example) on index.php to some file file.php which is on more higher level that site root (as always - index.php is in site root) -
if you can do thit (make such ref) - please post here pease of HTML with link and path which you'll have in browser adress line after visiting file.php

Member Avatar for blocblue

The whole point of the web root is that web accessible content should be in the web root or lower.

Content above the web root, e.g the server OS and other important files are protected. You can access these protected files via other scripts within the web directory, but you can never access them via the browser directly.

commented: +++++++ +3
Member Avatar for vedro-compota

The whole point of the web root is that web accessible content should be in the web root or lower.

Content above the web root, e.g the server OS and other important files are protected. You can access these protected files via other scripts within the web directory, but you can never access them via the browser directly.

this's full answer)) thank you, blocblue _))

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.