How to restrict PHP file access using .htaccess file? - php

Here is my .htaccess file
Options -MultiViews
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php?r=$1 [QSA,L]
My base folder contains one "index.php" file and "app" folder and the app folder contains some php files and i don't want to direct access these php files inside app folder using browser.

As worked out in the comments to your question your requirements are actually a little more complex than what you wrote in your question.
I guess this is what you are actually looking for:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} \.php$
RewriteRule ^(.*)$ index.php?r=$1 [QSA,L]
This will rewrite requests to index.php when the file name in the request ends in the .php file name extension.

Related

Rewrite all request to index.php (Including existing file and directory paths)?

I am working on a PHP application that I'd like to regulate file serving for various reasons. I need all requests to be passed to my index.php file. Currently I have this working for all requests except files and directories that exist. For security reasons and content protection I'd like to perform some challenges before serving files to the browser using readfile and I'd like to completely block directory access which will just show a 404 page for files and directories I don't want users to see (i.e., private content, php scripts, etc.).
This is my current HTACCESS file:
# Turn On Rewrite Engine
RewriteEngine On
# Directs all EE web requests through the site index file
RewriteCond %{REQUEST_URI} !^.*$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]
I don't no what to do with the RewriteCond that is causing files to be mapped to the index.php file if they don't exists. I'd like them to remap there whether or not they do exist.
For example, navigating to "http://www.example.com/some/real/script.php" would redirect the path to PHP regardless if it exists or not. Thanks guys in advance.
This one worked for me
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteBase /
# RewriteCond %{REQUEST_FILENAME} !-f
# RewriteCond %{REQUEST_FILENAME} !-d
# RewriteCond %{REQUEST_URI} !/folder
RewriteRule ^(.*)$ index.php?request=$1 [L,QSA]
</IfModule>

Codeigniter - .htaccess giving 404 Page Not Found (Files are in a sub-folder)

When I uploaded my file, I uploaded them in shared hosting. The thing is that the files and folders for my codeigniter are in one of those website name folders.
It gives me a 404 error when I visit the site.
My .htaccesss file:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
#Removes access to the system folder by users.
#Additionally this will allow you to create a System.php controller,
#previously this would not have been possible.
#'system' can be replaced if you have renamed your system folder.
RewriteCond %{REQUEST_URI} ^system.*
RewriteRule ^(.*)$ index.php?/$1 [L]
#When your application folder isn't in the system folder
#This snippet prevents user access to the application folder
#Submitted by: Fabdrol
#Rename 'application' to your applications folder name.
RewriteCond %{REQUEST_URI} ^application.*
RewriteRule ^(.*)$ index.php?/$1 [L]
#Checks to see if the user is attempting to access a valid file,
#such as an image or css document, if this isn't true it sends the
#request to index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?$1 [L]
</IfModule>
<IfModule !mod_rewrite.c>
ErrorDocument 404 index.php
</IfModule>
I really don't know what to do. Any help is appreicated. Thanks.
Edit: When I edit the index.php file and just put something like echo 'Hey'; and delete the .htaccess file, it works fine.
Based on your file structure:
The 404 error may be related to this part:
<IfModule !mod_rewrite.c>
ErrorDocument 404 index.php
</IfModule>
Which means: if the Apache module mod_rewrite.c is not being used or is not present, then all 404's are sent to index.php. If your codeigniter index.php is in your root "web" folder (public_html) then you should write ErrorDocument 404 /index.php instead. If it's in any sub-folders you need for example: /dyar.no/index.php and the remaining rules should also point to the same index.php.
Your current .htaccess works well if you place it near your index.php (the same folder of the root folder of your website).
Besides, an .htaccess is not useful if you don't have meaningful conditions and rules there. The one you have is specifically for codeigniter, which has a system and an application folder.
You can have multiple .htaccess files in your other websites' folders (if you're using codeigniter in more than one of them, copy that .htaccess to those sub-folders e.g.: if dyar.no is using codeigniter copy that .htaccess to that folder).
My suggestion
I noticed that you are also using Wordpress and thus those rules could be changed accordingly... So delete your current root .htaccess file (from the public_html folder) and install BulletProof Security plugin in your wordpress site. Once you do, in the admin dashboard (BPS tab) you just need to click generate secure .htaccess (it generates a strong .htaccess according to your file structure and will cover most of the security issues). After that activate it on the root folder and on the admin folder and you should have all of it covered.
The generated .htaccess can also be a good reference to write other .htaccess you may need.
http://www.askapache.com/htaccess/htaccess.html is one of the best references I found to understand and write .htaccess and here are a few examples.
Hope it helps!
Try this code:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]
</IfModule>
Add the following in your .htaccess file
RewriteEngine on
RewriteCond $1 !^(index\.php|folername|uploaded|dist|images|plugins|js|css|cache|robots\.txt)
RewriteRule ^(.*)$ /projectfoldername/index.php/$1 [L]
Note: projectfoldername is your htdocs or project folder name
Just try to change your last line as bellow and let me know please
RewriteRule .* index.php/$0 [PT,L]
Try this Code :
RewriteEngine on
RewriteCond $1 !^(index.php|resources|robots.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L,QSA]
try this code for .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L]
</IfModule>
also you need to change config > config.php
$config['base_url'] = '';
$config['index_page'] = '';
$config['uri_protocol'] = 'AUTO';
then your URL like this projectname/contrillerName/functionName/
I suggest using Rewrite base /{your codeigniter folder}/ in .htaccess which works for me.
In .htaccess
RewriteEngine on
RewriteCond $1 !^(index\.php|assets|image|resources|robots\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L,QSA]
In config.php (application/config)
$config['base_url'] = 'http://stackoverflow.com/'; # set this to prevent HOST Injectio.
$config['index_page'] = '';

can another .htaccess file can work in subfolder

I have a codeigniter site http://piyukarts.in/mss/ where in .htaccess file under mss contains
<IfModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine on
# Send request via index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L]
</IfModule>
but i cant access a link http://piyukarts.in/mss/posts, but i can access piyukarts.in/mss/index.php/posts, with this index.php/ after mss/
piyukarts.in/ is wordpress site, also having a .htaccess file
Please help.. thanks a ton in advance...
I made this change in .htaccess file and its working fine now.
RewriteEngine On
RewriteBase /mss
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1 !^(index\.php|images|robots\.txt|css|docs|js|system)
RewriteRule ^(.*)$ /mss/index.php?/$1 [L]
To answer:
can another .htaccess file can work in subfolder
is:
Yes.
.htaccess files in any folder in the file path tree to the file, will be applied to the file.
so file as /root/home/site/includes/css/horses.css the htaccess in any of those folders would be applied to the file horses.css .

htaccess: direct to php if php is present, if not, direct to directory

I have a php file at www.example.com/media.php
I also have a directory of the same name at www.example.com/media/manyotherfiles.php
If I enter my url as www.example.com/media or www.example.com/media/, I want to be directed to the file at www.example.com/media.php, instead of the files inside the work directory.
However, if I enter my url as www.example.com/media/manyotherfiles, I want to be directed to www.example.com/media/manyotherfiles.php. (it's more intuitive as the media.php file links to the pages in the media directory)
How can I do this with my .htaccess file? So far I have this to remove the .php file extensions:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.+?)/?$ $1.php [L]
Options -Indexes
Also, I am currently working on a beta directory on a local server, so for example, my files would be as such:
ip.address.here/beta/index.php
ip.address.here/beta/media.php
ip.address.here/beta/media/manyotherfiles.php
You can use this code in your DOCUMENT_ROOT/.htaccess file to hide .php extension:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/$1\.php -f [NC]
RewriteRule ^(.+?)/?$ /$1.php [L]

Loading a single file for all pages

I am running a Apache webserver, my goal is to have a loader (In PHP) that gets loaded from all URLs. For example if you head to website.com/test/, website.com/page.php or just website.com/ it will always load website.com/index.php
How can i achieve this?
You can create a .htaccess file that will rewrite the URL for anything this is not a file or directory on your server and redirect it to the index.php file. Additionally you can have the original URL attached as the query string so you can work with it in your script if need be.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php?$1 [L,QSA]
</IfModule>
Create a .htaccess file with the following lines and put it in the root directory of your website:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [QSA,L]
If a .htaccess file already exists, you can try appending those lines if there's no conflicting rules.

Categories