The following htaccess rules are given and set by the server management application:
<Directory "/var/www/vhosts/domain.com/httpdocs/wp-content">
<FilesMatch \.php$>
Require all denied
</FilesMatch>
</Directory>
This is actually fine except the fact that it should exclude a specific file which must be accessible:
/var/www/vhosts/domain.com/httpdocs/wp-content/plugins/plugin-name/public/image.php
Do you have an idea how to adjust the first rules to exclude the mentioned file from being blocked?
Thanks in advance
You could add one more FilesMatch condition that then allowed access to your file.
<Directory "/var/www/vhosts/domain.com/httpdocs/wp-content">
<FilesMatch \.php$>
Require all denied
</FilesMatch>
<FilesMatch image\.php$>
Require all granted
</FilesMatch>
</Directory>
This should work just fine.
Hope it helps.
If you want to look at more information about Apache configuration sections, take a look at their main documentation portal.
https://httpd.apache.org/docs/2.4/sections.html
Try with below,
<FilesMatch !image\.php$>
Require all denied
</FilesMatch>
Related
How can I deny access permission to an entire folder except one file?
For example, my DocumentRoot is "/var/www/html" and there I have a folder called example. In there, there are many files and one of them is index.php. So I want to give access permission only to this file, and deny access permissions to the other files in that folder.
did you try something like this into your apache configuration (server httpd.conf or .htaccess file) ?
<Directory "/var/www/html/example">
<FilesMatch index.php*>
Order allow,deny
Allow from all
</FilesMatch>
Order deny,allow
Deny from all
</Directory>
I am trying to deny everyone to download anything inside the "attachment" directory.
My website structure is:
public_html
-img
-css
-root
--attachment
---(numeric id)
----(files)
-js
What I am trying to do is, to deny access to root/attachment//
I tried many things, but I don't know why, I cannot get it working, my last tried was:
.htaccess - on main directory.
<FilesMatch "root/attachment/.*/.*">
Order Allow,Deny
Deny from all
</FilesMatch>
Any ideas?
Thank you very much :)
FilesMatch doesn't work with directories.
Create a new .htaccess inside root/attachment/ as
<FilesMatch ".*">
Order Allow,Deny
Deny from All
</FilesMatch>
Redirect rules specified in a parent directory .htaccess apply to its sub-directories as well. In case, these access rules do not work the same way, just move the .htaccess directly into files directory.
Create a new htaccess file /root/attackment/.htaccess and add the following lines
Order Allow,Deny
Deny from all
So I browsed through all the htaccess solutions but none are good for my scenario...
Basically I want to deny direct access to all file types except the ones listed, like this:
Order Deny,Allow
Deny from All
<FilesMatch ".(flv|gif|jpg|jpeg|png|ico|swf|js|css|less|pdf|php|html)$">
Allow from All
</FilesMatch>
The problem is I can't use urls like /?foo=bar but must use /index.php?foo=bar ...
How to solve this? RewriteCond? Can anyone drop a oneliner that does the same?
Thanks.
This worked:
<FilesMatch ".(flv|gif|jpg|jpeg|png|ico|swf|js|css|less|pdf|php|html|htm)$">
Allow from All
</FilesMatch>
<FilesMatch "^(index\.php)?$">
Allow from all
</FilesMatch>
I have the following .htaccess file:
RewriteEngine On
RewriteBase /
# Protect the htaccess file
<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>
# Protect log.txt
<Files ./inscription/log.txt>
Order Allow,Deny
Deny from all
</Files>
# Disable directory browsing
Options All -Indexes
I am trying to forbid visitors to access the following file:
domain.example/inscription/log.txt
but what I have above does not work: I can still access the file from the browser remotely.
Within an htaccess file, the scope of the <Files> directive only applies to that directory (I guess to avoid confusion when rules/directives in the htaccess of subdirectories get applied superceding ones from the parent).
So you can have:
<Files "log.txt">
Order Allow,Deny
Deny from all
</Files>
For Apache 2.4+, you'd use:
<Files "log.txt">
Require all denied
</Files>
In an htaccess file in your inscription directory. Or you can use mod_rewrite to sort of handle both cases deny access to htaccess file as well as log.txt:
RewriteRule /?\.htaccess$ - [F,L]
RewriteRule ^/?inscription/log\.txt$ - [F,L]
Strong pattern matching — This is the method that I use here at Perishable Press. Using strong pattern matching, this technique prevents external access to any file containing “.hta”, “.HTA”, or any case-insensitive combination thereof. To illustrate, this code will prevent access through any of the following requests:
.htaccess
.HTACCESS
.hTaCcEsS
testFILE.htaccess
filename.HTACCESS
FILEROOT.hTaCcEsS
..etc., etc. Clearly, this method is highly effective at securing your site’s HTAccess files. Further, this technique also includes the fortifying “Satisfy All” directive. Note that this code should be placed in your domain’s root HTAccess file:
# STRONG HTACCESS PROTECTION
<Files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</Files>
I don't believe the currently accepted answer is correct. For example, I have the following .htaccess file in the root of a virtual server (apache 2.4):
<Files "reminder.php">
require all denied
require host localhost
require ip 127.0.0.1
require ip xxx.yyy.zzz.aaa
</Files>
This prevents external access to reminder.php which is in a subdirectory.
I have a similar .htaccess file on my Apache 2.2 server with the same effect:
<Files "reminder.php">
Order Deny,Allow
Deny from all
Allow from localhost
Allow from 127.0.0.1
Allow from xxx.yyy.zzz.aaa
</Files>
I don't know for sure but I suspect it's the attempt to define the subdirectory specifically in the .htaccess file, viz <Files ./inscription/log.txt> which is causing it to fail. It would be simpler to put the .htaccess file in the same directory as log.txt i.e. in the inscription directory and it will work there.
Place the below line in your .htaccess file and replace the file name as you wish
RewriteRule ^(test\.php) - [F,L,NC]
Well you could use the <Directory> tag
for example:
<Directory /inscription>
<Files log.txt>
Order allow,deny
Deny from all
</Files>
</Directory>
Do not use ./ because if you just use / it looks at the root directory of your site.
For a more detailed example visit http://httpd.apache.org/docs/2.2/sections.html
I try to configure my Apache .conf file to deny listing from a certain category, but I want to allow a specific file inside this category.
It appears that the Directory rule is "stronger" than the Files rule, so when using both - I can't access that certain file.
This is what I try:
<Directory /var/www/denied_directory>
order deny,allow
Deny From All
</Directory>
<Files safefile.php>
Order Allow,Deny
Allow from All
</Files>
It works perfectly if it is configured properly:
<Directory /var/www/denied_directory>
Order allow,deny
<Files test.php>
Order deny,allow
</Files>
</Directory>
In Apache 2.4, with an additional test on an environment variable for good measure:
See also: Require Directive
<Directory "/wikis/foswiki">
Require all denied
# Allow access to toplevel files ending in .html (in particular index.html) only
# (comment out if you don't care for this)
<Files ~ "\.html$">
<RequireAll>
Require all granted
Require not env blockAccess
</RequireAll>
</Files>
</Directory>
put your files directive inside your directory directive.
To allow a specific file when access is restricted by HTTP password. Be careful, password protection is defined on filesystem basis and specific allowed files are defined by URI. Updated for Apache 2.4.
<Directory /path/to/directory/>
AuthName SecureArea
AuthType Basic
AuthUserFile /path/to/passwd-file
Require user my-user
SetEnvIf Request_URI "path/to/uri-allowed-1.php" allowedURL
SetEnvIf Request_URI "path/to/uri-allowed-2.php" allowedURL
Require env allowedURL
</Directory>
There is a missing line in #acond's answer. I think it needs Allow:
<Directory /var/www/denied_directory>
order deny,allow
Deny from All
<Files safefile.php>
order deny,allow
Allow from All
</Files>
</Directory>
Since there is only one rule in each directive, I suspect the order lines may be irrelevant. Although maybe the outermost one is required, because there is more than one rule nested. (I'm new to apache configuration)
Create an .htaccess file in the directory (folder) and use the block below:
order deny,allow
deny from all
<Files safefile.php>
allow from all
</Files>
This will allow ../safefile.php file but ../.
If you want to allow ../ (for instance you need to have ../index.php), then you should do this:
order deny,allow
deny from all
<FilesMatch ^(index\.php)?$>
allow from all
</FilesMatch>