I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).

Do you think this is a security hole?
If yes, in which sense?

What you're describing is normal directory listing



In itself, directory listing is not a security issue. If the security of your system is compromised after figuring out the structure of your files and directories, then you're relying on security through obscurity, which is bad. Examples of this bad practice include:


Using secret directory names to access sensitive files.
Limiting the execution privileged functions to only access their URLs rather than using proper permissions.
Leaving special doors/backdoors for developers.


However, as part of a good security policy, after implementing proper security measures, it's beneficial to obscure the working parts of your system. The less you show about your system, the less information an attacker can get on you, which means you're making their job more difficult.

"So, what should I do?" you ask. Simple: Disable directory listing in your web server configurations. In Apache, you go to your httpd.conf and find the line where it says

Options Includes Indexes


Remove Indexes from the line, then restart your apache.
