Topic: Securing from RFI's when fopen is on.

[CrimsonSoul]

I know it's possible to do in .htaccess but when you ahve the fopen permission on in php.ini is there a way to secure from RFI's from the Apache config or is the only way to do it in the .htaccess? Thanks guys

[glsmith]

IMHO (many times it's wrong) I cannot think of anything that can only be in a htaccess. Plenty of things that can only be in the server config, but not htaccess alone. But then I haven't a real clue what your talking about

That said, I'll show you how to find out. Let's look at the Docs for answers, yes they are there. Let's look at the BrowserMatch directive for example;
http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html#browsermatch

Now, look in the box below the directive heading and you'll see the line for "Context" Obviously, BrowserMatch can be used in the main server config. inside a <VirtualHost> container, a <Directory> container or in an htaccess file.

Have fun

-edit-

A couple seconds on Google and I do know what you are talking about.
Syntax: RewriteEngine on|off
Default: RewriteEngine off
Context: server config, virtual host, directory, .htaccess

So yes