I'm trying to limit access to a directory based on the results of a php script. I have the following in my .htaccess folder where the files are located:
RewriteCond %{REQUEST_URI} !=league_access.php
RewriteRule .* league_access.php
I have also tried:
RewriteEngine on
RewriteRule .* league_access.php
If you go to the directory http://www.bowling-tracker.com/bowl/league_documents/1/ you will note that it is firing the league_access.php script (as it currently only types "Running the Test Script
Restricted access" to the page.
So that is acting correctly.
http://www.bowling-tracker.com/bowl/league_documents/1/test.html you will see that you're granted access to the page (rather than it going to the league_access.php script).
This website is on FastComet (public hosting company) so I cannot change server settings or files except the .htaccess file.
Any help to resolve this would be greatly appreciated.
Thanks....
FastComet Team here! Part of our shared hosting environment is utilizing NginX as a reverse proxy to the Apache web service. This configuration gets the advantages of both services at the same time and ensures a better performance of your project. NginX is processing all requests for static content, such as PDF files or HTML pages. Here's a list of all file types that will be processed by the NginX service:
3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso
However, if the request is for dynamic content, such as a PHP script, it will be passed from the NginX to the Apache service. You are correctly setting the rule in question in the .htaccess file of your website, but this file is only read by the Apache service, not NginX. In other words, if there is a request for a static content, such as a PDF file here:
http://www.bowling-tracker.com/bowl/league_documents/1/Rules_Thurs_Night_Mixed.pdf
or an HTML page here:
http://www.bowling-tracker.com/bowl/league_documents/1/test.html
it will be processed by NginX without considering the .htaccess rules that you have set. There is an easy way of resolving that by excluding the processing of HTML, HTM and PDF types files for your domain or even your entire hosting account. This way, those requests will be processed by the Apache web server, instead of NginX. In this case, the .htaccess rules that you apply will be taken into consideration by the system and they will work without any issues.
Related
I need to prove ownership of SSL in order to switch hosts and reroute DNS. I have the file in the .well-known/acme-challenge/ folder, but the folder is 403 forbidden so the test fails. The site is running Drupal 7 and I have the lets encrypt challenge module installed as well
I have tried editing the .htaccess to add RewriteRule "(^|/)\.(?!well-known)" - [F] but this has no effect. I have tested the .htaccess file by adding junk text and did get the 500 error, so I know it is being used. What could be getting in the way of this edit? Do I need to restart a process on the server?
I solved this by finding the .httpdconf for the domain on the server (not the main one for the server) and adding a clause to allow specific access to that directory.
The verification files were then able to be found and site is launched now on new host and server.
If I have a user follow a link to my site such as
mydomain.com/pdf/google_token
is there a way for me to redirect them to the Google pdf
drive.google.com/file/d/google_token/view
while keeping
mydomain.com/pdf/google_token
in the address bar?
Right now I am redirecting to google successfully using
RewriteRule ^pdf/([a-zA-Z0-9]+)$ https://drive.google.com/file/d/$1/view
in my .htaccess file, but it is replacing the URL with
drive.google.com/file/d/google_token/view
Thanks.
You are not looking for a way to redirect. A redirection always changes the URL in the client, that is the whole purpose of a redirection. What you are looking for is a proxy solution, maybe in conbination with an internal rewrite. That creates a kind of mapping: the content published on that google resource is re-published through your http host.
This would be an example for such setup:
ProxyPass /google-drive/ https://drive.google.com/
ProxyPassReverse /google-drive/ https://drive.google.com/
RewriteEngine on
RewriteRule ^/?pdf/([a-zA-Z0-9]+)$ /google-drive/file/d/$1/view [END]
An alternative would be to only re-publish a section of that remote resource:
ProxyPass /google-drive/ https://drive.google.com/file/d/
ProxyPassReverse /google-drive/ https://drive.google.com/file/d/
RewriteEngine on
RewriteRule ^/?pdf/([a-zA-Z0-9]+)$ /google-drive/$1/view [END]
That set will work likewise in the http servers host configuration and you probably can also get it to work using a dynamic configuration file (".htaccess" style file). If you really need to use such a file then take care that its interpretation is enabled in the host configiration. And you definitely need to have apache's proxy module loaded. You should prefer to place such rule in the http servers host configuration though, for various reasons.
If that setup is not possible, for example because you do not have access to the proxy module, then you can implement a simple routing solution which fetches the PDF in background using for example php's cURL extension and forwarding the payload along with correct http headers to the client that sent a request to that PDF. That is usually done for resources kept locally but there is no reason why you can't do that with remote resources too.
Some additional notes:
if you only deliver documents form that google drive resource, then you probably do not need the ProxyPassReverse directive, but only the ProxyPass.
if you run into a server internal error (http status 500) using the above setup then chances are that you operate a very old version of the apache http server. You will find a hint on an unsupported END flag in your http servers error log file in that case. Try using the [L] flag in that case, it probably will work the same here, but that depends on the rest of your setup.
In my yii project i have Changelog and Licence text files. I know about RBAC and applied it on every Controller but how can i prevent any guest user to view these text files. As till now anyone can view this.
I have used this in my htaccess file
<Files ~ "(.txt)">
Order allow, deny
Deny from all
</Files>
But this is worked for txt file and these files have no extension
You can block access to all the files without extension using this rule in your site root .htaccess or Apache config/vhost file:
RewriteEngine On
# If the request is for a valid file
RewriteCond %{REQUEST_FILENAME} -f
# if there is no extension then block
RewriteRule ^[^.]+$ - [F]
You question is a little board, and so the answer is a little general. but there are a couple approaches;
option 1. remove the Changelog and Licence files? if these are yii install changelog and licence then they dont need to be left on the server. just ensure you complying with the licence requirements.
option 2.
you mentioned "guest user" which htaccess is not going to integrate well with yii for authorized users. you could move the files into a folder with a .htaccess containing a single line Deny from all. this blocks everyone except the PHP executed on your server.
you can now create a method/action in a controller which just echos the file contents. file-get-contents or readfile. wrap this your authentication so only non-guest users are able to use the method.
if there are only two static files, then maybe just an 'action' for each. if its many files that are changing names etc, then you accept an id to the controller pass to a model that uses scandir and checks the file really exists and spits out your output to view.
option 2.1
instead of folder with a .htaccess you could also move the files to the parent of the webhost base dir if you have this access. this means that your webserver can not serve the file, but the php can still reach it with local paths.
option 3
in .htaccess you can use AuthType basic and will invoke your webserver to prompt the user for username and password as configured in the .htaccess. this is problematic as the interface is not user friendly and is very difficult to integrate with your webapps user db.
option 4
.htaccess can support other AuthTypes but option 2 becomes much easier at this point.
I'm using S3 and CloudFront to store the images, CSS and JS files of my web site - which is not static and is hosted on a proper web server
Since the CSS file changes frequently, I'm using a version number to make sure the user browser reloads it when it changes. When I was hosting the CSS file on my Apache web server, I was using the following redirect rule
RewriteEngine On
# CSS Redirection (whatever.min.5676.css is redirected to whatever.min.css)
RewriteRule ^(.*)\.min\.[0-9]+\.css$ $1.min.css
With this simple rule, http://www.example.com/all.min.15.css redirected to http://www.example.com/all.min.css
How can I reproduce such a rule with Amazon S3 and/or CloudFront ?
i.e. to have http://example.amazonaws.com/mybucket/css/all.min.3.css or http://example.amazonaws.com/mybucket/css/all.min.42.css redirected to http://example.amazonaws.com/mybucket/css/all.min.css
(Note : my S3 bucket is NOT configured as a website but should it be so to enable redirection rules?)
NOTE: this answer does not use any rule. It might not be the proper answer.
I would be using a query parameter to handle different versions, like:
http://example.amazonaws.com/mybucket/css/all.min.css?ver42
http://example.amazonaws.com/mybucket/css/all.min.css?42
http://example.amazonaws.com/mybucket/css/all.min.css?ver=42
http://example.amazonaws.com/mybucket/css/all.min.css?20141014
To be exact, in my dynamic web page, the version parameter is stored in a variable and appended to url (both CSS and JS). While in development I only have to increase/set one variable to force the browser to load a new version. This way, there is no need for rewrite rules, even on Apache.
Caching also works as the Last-Modified and ETag headers are kept in tact.
Hope this helps.
I am having configuration settings with my multi website magento setup.
I have a website running at abc.com . Now for international storefront I have created another website, store view and store with abc_international as the website code.
In my configuration, I have configured Base URL as abc.com/int/
However, when I access the URL abc.com/int/ it generates a 404 error.
Another important point is even if I specifically make changes in index.php as follows -
$mageRunCode = "abc_international";
$mageRunType = "website";
Mage::run($mageRunCode, $mageRunType);
Any ideas as to what might be the problem.
You need to copy index.php and .htaccess files to abc.com/int/ at server and provide particular path to Mage.php file at index.php which is inside abc.com/int/ and in that index.php file you need to modify Mage::run($mageRunCode, $mageRunType); to Mage::run("abc_international", "website"); then it will work if you properly configured multi-website setup.