Deny access to all files but index.php but allow GET variables - .htaccess

Basically I do not want people that visit my site to get all of the files, but all the things I tried and found on the internet disallow the usage of GET variables after the index.php. I'm using a rewrite to make domain.com/lol go to index.php?lol.
This is my current .htaccess file, if you'd like to modify it to make it easier for me, go ahead too.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.domain\.com [NC]
RewriteRule .? http://domain.com%{REQUEST_URI} [L,R=301]
RewriteRule ^act/(.*)$ index.php?act=$1
RewriteRule ^code/(.*)$ index.php?code=$1
RewriteRule ^login$ index.php?login
RewriteRule ^logout$ index.php?logout
RewriteRule ^add$ index.php?add
RewriteRule ^tac$ index.php?tac
RewriteRule ^profile$ index.php?profile

Following rule stops direct requests to index.php (either with or without) arguments:
# block direct requests to index.php and redirect it to /
RewriteCond %{ENV:REDIRECT_STATUS} =""
RewriteRule ^index.php$ /
If needed, you can change the rewrite target and/or add some more conditions based on what exactly is allowed and what's not.

Related

.htaccess rewrite to same alias without infinite redirects

I have...
| .htaccess : (v1)
RewriteEngine on
RewriteRule ^in?$ login.php
So, /in --is-really--> /login.php
This much works great. We all can learn how to do this from: .htaccess redirect with alias url
But, I want it to also work in reverse...
If someone should enter /login.php into the address bar, I want it to change to /in.
So also, /login.php --rewrites-to--> /in
From this Answer to a different Question, I want to be ready for anything, using REQUEST_URI. So, my .htaccess file starts with this...
| .htaccess : (v2)
RewriteEngine on
# Remove index.php, if a user adds it to the address
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{REQUEST_URI} ^/(.+/)?index\.php
RewriteRule (^|/)index\.php(/|$) /%1 [R=301,L]
# "in" --> login.php
RewriteRule ^in?$ login.php
That also works great.
But now, I want to add this rule (my Question here) for /in <--> /login.php both ways, just how / <--> /index.php already works with .htaccess (v2). So, I adopted the settings and added a second rule...
| .htaccess : (v3) —not working!
RewriteEngine on
# Remove index.php, if a user adds it to the address
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{REQUEST_URI} ^/(.+/)?index\.php
RewriteRule (^|/)index\.php(/|$) /%1 [R=301,L]
# "in" --> login.php, and also redirect back to it
RewriteCond %{REQUEST_URI} ^/(.+/)?login\.php
RewriteRule (^|/)login\.php(/|$) /%1in [R=302,L]
RewriteRule ^in?$ login.php
...but then /in and /login.php both cause an infinite redirect loop.
What's the right way to do this, still using REQUEST_URI, and still having both rewrite rules (for index.php and for login.php)?
These Questions did not help:
Rewrite rule to hide folder, doesn't work right without trailing slash
This is not about a trailing slash
Allow multiple IPs to access Wordpress Site Admin via .htaccess
This is not about IP-based access
Htaccess URLs redirects are working for http not all https
This is not about https vs http
Rewrite-rules issues : .htaccess
This is not about cleaning up the GET array in the URL
apache htaccess rewrite with alias
This is not about rewriting the host/domain, thereby preserving the path
rewrite htaccess causes infinite loop?
This is not about www subdomain rewrites
.htaccess rewrite page with alias
This is not about rewriting "pretty" URLs nor about how to use slug settings in WordPress
Htaccess alias or rewrite confusion
This is not about simply having multiple rules with the same destination
htaccess rewrite to include #!
I'm not trying to rewrite #!
Reason of redirect loop is a missing RewriteCond %{ENV:REDIRECT_STATUS} ^$ before first redirect rule that removes index.php. Remember that RewriteCond is applicable to immediate next RewriteRule only.
Suggested .htaccess:
RewriteEngine on
# Remove index.php, if a user adds it to the address
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{REQUEST_URI} ^/(.+/)?index\.php$ [NC]
RewriteRule ^ /%1 [R=301,L]
# "in" --> login.php, and also redirect back to it
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{REQUEST_URI} ^/(.+/)?login\.php$ [NC]
RewriteRule ^ /%1in [R=302,L]
RewriteRule ^in?$ login.php [L,NC]
It won't cause redirect loop because after first rewrite to /login.php, variable REDIRECT_STATUS will become 200 and then the RewriteCond %{ENV:REDIRECT_STATUS} ^$ will stop redirect looping.
Thanks to the help from the user with the correct answer, I found that...
RewriteCond %{ENV:REDIRECT_STATUS} ^$
...doesn't go in .htaccess only once, but every time on the line before...
RewriteCond %{REQUEST_URI} ...

Mod_rewrite - Multiple rules in .htaccess

I'm setting up a slightly more complexed web site than I normally are used to using a bespoke CMS system and have hit a stumbling block.
Basically what I am wanting to achieve is a simple top level page structure so the urls are clean as follows:
http://www.mywebsite.com/page.php?page_url=val1
http://www.mywebsite.com/val1
Not normally a problem, but the existing .htaccess already has several RewriteRules existing and any variation of adding a RewriteRule conflicts and prevents select pages from working.
Tried variations around...
RewriteCond %{QUERY_STRING} ^page=(.+)
RewriteRule ^$ /%1? [R=301,L]
With no joy.
Do I need to rethink my strategy or is there something I'm just quite simply overlooking?
Should I be rethinking towards making the top-level-category page 'market.php' do the work rewriting in the # Specify MARKET LEVEL rewrite
My existing .htaccess is as follows and works fine after a thorough testing but changing to include the new top level page causes it to error.
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
# Force search engines to use www
RewriteCond %{HTTP_HOST} !^www\.mywebsite\.com$
RewriteRule ^(.*) http://www.mywebsite.com/$1 [R=301,L]
# Specify MARKET LEVEL rewrite
RewriteRule ^top-level-category-1$ /market.php?p=top-level-category-1 [L]
RewriteRule ^top-level-category-2$ /market.php?p=top-level-category-2 [L]
RewriteRule ^top-level-category-3$ /market.php?p=top-level-category-3 [L]
RewriteRule ^top-level-category-4$ /market.php?p=top-level-category-4 [L]
RewriteRule ^top-level-category-5$ /market.php?p=top-level-category-5 [L]
RewriteRule ^top-level-category-6$ /market.php?p=top-level-category-6 [L]
Options +FollowSymLinks
# Specify OFFER LEVEL rewrite
RewriteRule offer/(.*)/ offer.php?p=$1
RewriteRule offer/(.*) offer.php?p=$1
# Specify CLAIM OFFER LEVEL rewrite
RewriteRule get-offer/(.*)/ reveal.php?claim=$1
RewriteRule get-offer/(.*) reveal.php?claim=$1
# Specify CLAIM EVENT LEVEL rewrite
RewriteRule event-bonus/(.*)/ reveal-event.php?claim=$1
RewriteRule event-bonus/(.*) reveal-event.php?claim=$1
# Specify SEARCH LEVEL rewrite
RewriteRule search/(.*)/ search.php?p=$1
RewriteRule search/(.*) search.php?p=$1
# Specify EVENT LEVEL rewrite
RewriteRule offers/(.*)/ offers.php?p=$1
RewriteRule offers/(.*) offers.php?p=$1
# Specify BLOG LEVEL rewrite
RewriteRule blog/(.*)/ blog.php?p=$1
RewriteRule blog/(.*) blog.php?p=$1
RewriteRule view-blog/(.*)/ view-blog.php?p=$1
RewriteRule view-blog/(.*) view-blog.php?p=$1
# Specify EXPIRED OFFER LEVEL rewrite
RewriteRule offer-expired/(.*)/ offer-expired.php?p=$1
RewriteRule offer-expired/(.*) offer-expired.php?p=$1
Try using this RewriteRule in your .htaccess
RewriteEngine On
RewriteRule ^([^/]*)$ /page.php?page_url=$1 [L]
It should leave you with your desired URL.

htaccess subdomain to subdomain/subfolder

This is driving me crazy. Basically, I want to redirect the following:
http://subdomain.mysite.com/ (with or without trailing slash)
to (exactly)
http://subdomain.mysite.com/subdomain/
This currently gives me an endless loop
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteRule ^(.*)$ subdomain/$1 [R=301]
But whatever rule I try, it always ends up in a loop because the target still matches the redirect criteria. Some help would be appreciated.
You need to add a condition to break the endless loop.
Note that this loop will only arise if you really want to keep the host name unaltered, so rewrite inside the same host, but still do an external redirect as you suggest. This is somewhat surprising, but certainly possible:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,R=301,QSA]
This implements an external redirection, the additional condition is required to prevent the redirection loop:
https://subdomain.example.com/foo > https://subdomain.example.com/subdomain/foo
The same loop does not arise if you rewrite to another host name:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/subdomain/$1 [L,R=301,QSA]
This implements an external redirection, no additional condition is required, since the existing one already prevents the redirection loop:
https://subdomain.example.com/foo > https://www.example.com/subdomain/foo
A more often seen approach is to only rewrite internally, so without actually changing the URL visible in the browser:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,QSA]
This implements an internal redirection, so the visible URL in the client stays unchanged:
https://subdomain.example.com/foo > /subdomain/foo
Doesn't seem to work at all. I know its a bit strange but its for legacy reasons. The whole server mysite.com is old and just for archive purpose - and requires authorization to access. Except the /subdomain folder which still needs to be accessible.
mysite.com and subdomain.mysite.com point to the same home directory (historical reasons..)
With this setup http://subdomain.mysite.com/subdomain/ works perfectly fine ... but someone here really wants http://subdomain.mysite.com/ to work as well
This is my current htaccess
<FilesMatch "index.php">
AuthName "Protected Area"
AuthType Basic
AuthUserFile /home/www/.htpasswd
require valid-user
</FilesMatch>
#PIE.htc
AddType text/x-component .htc
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,R=301,QSA]
#more rules here
And inside the /subdomain folder I simply say
Satisfy Any
Allright ... I got it to work with an external redirect with www.!
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteRule ^(.*)$ http://www.subdomain.mysite.com/subdomain/$1 [L,R=301,QSA]
Problem with this is, http://subdomain.mysite.com/subdomain/ now redirects to http://www.subdomain.mysite.com/subdomain/subdomain/ - so I setup a php redirect in the subdomain/subdomain/ folder ...
it seems messy but the site is visible when you open subdomain.mysite.com :)

Root redirects to just one subdomain in .htaccess

I want the root of my website (www.bitumephotofest.it) to redirect to a subdomain (2016.bitumephotofest.it) (I am running a Wordpress multisite). It works.
But I have another subdomain (2015.bitumephotofest.it) and it also redirects to 2016.bitumephotofest.it.
I want the redirect to work only between www.bitumephotofest.it and 2016.bitumephotofest.it. 2015.bitumephotofest.it should be independent as it is a different website.
I tried to look for questions by people with a similar situation but there is always something different and, anyway, those solutions does not work for me.
Here is my code:
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} 2016.bitumephotofest.it
RewriteCond %{REQUEST_URI} !wordpress/
RewriteRule ^(.*)$ /wordpress/$1 [L]
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]
RewriteRule !^(2016) http://2016.bitumephotofest.it [L,R]
Does anyone know what I am missing?
Thank you in advance!
If you want the domain 2015.bitumephotofest.it stay unmodified, you can sort of exit the rewrite rule chain with
RewriteCond %{HTTP_HOST} ^2015\.bitumephotofest\.it$
RewriteRule ^ - [L]
- as the target means don't rewrite, see RewriteRule
- (dash)
A dash indicates that no substitution should be performed (the existing path is passed through untouched). This is used when a flag (see below) needs to be applied without changing the path.

RewriteRule For Matching Arbitrary PHP Files

I'm somewhat new to htaccess rewrite rules, and have been scratching my head for the past few days on what's happening here. No amount of Googling seemed to help, so hopefully somebody knows the answer.
I have a site that can be accessed as:
www.site.com
www.site.com/684
www.site.com/684/some-slug-name-here
All of these scenarios should go to index.php and pass in the optional id=684 and slug=some-slug-name-here
Which works fine.
My problem is I have a separate file. Right now it's called admintagger.php - but this fails when I call it anything. 21g12fjhg2349yf234f.php has the same issue.
The problem is that that I would like to be able to access admintagger.php from www.site.com/admintagger
but it seems to be matching my rule for index, and taking me there instead.
Here is my code:
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteRule ^imagetagger$ /imagetagger.php [NC,QSA]
RewriteRule ^([0-9]+)/?(.*)?/?$ index.php?id=$1&slug=$2 [NC,L,QSA]
If you want to arbitrarily be able to access php files via the name (sans extension) then you need to create a general rule for it. But you need to be careful otherwise you may be rewriting legitimate requests for existing resources (like a directory, or a slug). Try this instead:
# make sure we aren't clobbering legit requests:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
# see if appending a ".php" to the end of the request will map to an existing file
RewriteCond %{REQUEST_FILENAME}.php -f
# internally rewrite to include the .php
RewriteRule ^(.*)$ /$1.php [L]
Then you can have your routing to index.php right after that:
RewriteRule ^([0-9]+)/?(.*)?/?$ index.php?id=$1&slug=$2 [NC,L,QSA]
Although you may be better off create a separate rule for each of your 3 cases:
RewriteRule ^([0-9]+)/([^/]+)/?$ /index.php?id=$1&slug=$2 [NC,L,QSA]
RewriteRule ^([0-9]+)/?$ /index.php?id=$1 [NC,L,QSA]
RewriteRule ^$ /index.php [L]

Resources