htaccess block access to directory but allow access to files - php

I have such situation.
I'm developing application in Zend Framework and htaccess pointing every request to
index.php. If some file or directory exists on the request path then htaccess allow access to this files like css, js, images etc...
Now I have for example such link:
example.com/profile/martin-slicker-i231
With Zend Router it points to controller account and action viewprofile. I want to add some avatart for my users and I created directory in public folder (so the images would be accessible by the server like css and js). The directory is named "profile" and subdirectory in it is "martin-slicker-i231". All path is visible by server like that:
public/
.htaccess
index.php
profile/
martin-slicker-i231/
avatar-small.jpg
The problem is when i point browser to example.com/profile/martin-slicker-i231 it
points me to this directory not the controller and action. When I remove the folder with user then the flow go to the controller and action. How to configure .htaccess so the example.com/profile/martin-slicker-i231 will be pointing to controller and action but request to example.com/profile/martin-slicker-i231/avatar-small.jpg point to the file. Here is my .htaccess
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
Can somebody help?

Just remove the portion that says that it should serve directories:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
Now it will serve files (with size > 0) and symbolic links directly, but send directory references and other urls to your application

According to the Apache docs the following will turn off directory listings
<Directory /path/to/directory>
Options -Indexes
</Directory>
You might also want to look at the documentation for mod_autoindex

Related

Need Help To Protect my MVC PHP app folder using htaccess

I have an issue with my .htaccess.
Let's say that my app folder are:
/APP/
/CONTENT/
/UPLOADS/
/ASSETS/
And I have a .htaccess file that point all requests to my index.php, and the index php there is an included file called router.php that manage my roots:
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([\s\S]*)$ index.php?url=$0 [QSA,L]
What i would want to do right now is to point APP and CONTENT folder also to the .htaccess and like that, i can display my custom 404 error page.

MVC public folder htaccess is not working

I recently moved my index.php (the file that handles routing) and CSS, JavaScript, and font assets to a public/ folder. I only want items in this public/ folder to be accessible for security purposes. I ran into this problem when I realized I could visit mysite.com/composer.lock and view the composer lock file with my old .htaccess and folder setup.
Here is what I want
If I visit mysite.com/car/create, I want it to actually point to mysite.com/public/index.php?path=car/create
If I link to an asset such as mysite.com/css/style.css, I want it to really point to mysite.com/public/css/style.css
Here is my folder structure
Here is my .htaccess which is not working at all
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)$ public/index.php?path=$1 [L,QSA]
</IfModule>
How can I fix this? It just generates empty pages and I can still directly visit files in the root directory, etc.
Your existing directives specifically avoid rewriting requests for existing files, so it would still enable you to visit files in the root directory. It will also rewrite static resources to public/index.php?path=, which will presumably fail.
Try the following instead:
RewriteEngine On
# Stop processing if already in the /public directory
RewriteRule ^public/ - [L]
# Static resources if they exist
RewriteCond %{DOCUMENT_ROOT}/public/$1 -f
RewriteRule (.+) public/$1 [L]
# Route all other requests
RewriteRule (.*) public/index.php?path=$1 [L,QSA]

moving project to a subfolder messes my script path and url

I am developing the website in my local server in a root folder, the problem is that when my client told me to upload the website in to their server, it is located in the subfolder. So the url has been like this. http://example.com/myproject
The problem with that format is that all my css,js, ajax calls are messed up because when I tried to check Firebug/chrome console, I am seeing a http://example.com/assets/css/main.css , where in fact it should be http://example.com/myproject/assets/css/main.css
All my scripts are coded to be like this:
<link rel="stylesheet" href="/assets/css/main.css"> since that works perfectly when the project is not in a subfolder.
My question now is that, is there a trick, maybe in the .htaccess or mod_rewrite that would allow me to tell the browser that always add a /myproject in all my script calls?
The reason for this is that I don't want to change all my script calls and add a /myproject/...
This is the sample of my .htaccess:
Options +FollowSymLinks
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
<Files .*>
Order Deny,Allow
Deny From All
</Files>
# Allow asset folders through
RewriteRule ^(fuel/modules/(.+)?/assets/(.+)) - [L]
# Protect application and system files from being viewed
RewriteRule ^(fuel/install/.+|fuel/crons/.+|fuel/data_backup/.+|fuel/codeigniter/.+|fuel/modules/.+|fuel/application/.+) - [F,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [L]
# Prevents access to dot files (.git, .htaccess) - security.
RewriteCond %{SCRIPT_FILENAME} -d
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)\." - [F]
</IfModule>
Options -Indexes
Your help will be greatly appreciated! Thanks!
If you are unable/unwilling to edit your site then you will need to edit the .htaccess file (or server config) in the site's document root. To rewrite all requests for non-existent files to your project's subdirectory:
For example, something like:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/myproject%{REQUEST_URI} -f
RewriteRule !^myproject/ /myproject/$0 [L]
For all requests for files not in the /myproject subdirectory, that don't exist, but do exist in the /myproject subdirectory then internally rewrite the request to the /myproject subdirectory.
This assumes that your (sub)site consists of real files that exist on the filesystem.
This will make it look as though your project is hosted in the document root. You could externally redirect (R=301) - but that would result in every page triggering multiple redirects which is to be avoided!
However, whether this works at all will depend on what else your client is hosting on their site.
I think the best solution is to edit your files.
UPDATE: Since your site has a front controller (ie. you are routing all requests for non-existent files through index.php) then the above directives won't quite work.
However, if the client is simply hosting a site that consists of real files on the filesystem then this could probably be simplified to:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule !^myproject/ /myproject/$0 [L]
In Unix based filesystems (which the web path is based on), the / at the beginning of a path is an absolute path to the root level.
For web addresses, this means it goes directly to the document root of your website.
You will need to remove the beginning / from your href attributes
<link rel="stylesheet" href="assets/css/main.css">

Redirect all requests to a directory and it's subdirectories to a file inside the directory, using Apache2 server

The Document folders are structured like this
/var/wwww/ (root)
java/
...
php/
projectone/
controller/
view/
index.php
...
projecttwo/
...
I want all requests to /php/projectone or it's subfolders to redirect to /php/projectone/view/index.php, while requests to /php/projecttwo and other folders should not be redirected.
I believe using mod_rewrite is the way, however, I still haven't achieved what I want.
Place an .htaccess inside project one folder with the following rule:
Options +FollowSymLinks -MultiViews
RewriteEngine On
RewriteBase /php/projectone/
RewriteRule ^(view/)?index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . view/index.php [L]
And you can repeat that for any other project folders you have. by changing the RewriteBase.

.htacces: page got called multiple times

I made a website that I run locally. I configured a my host file and virtual host:
Adress: website.dev
DocumentRoot: /www/website/public_html
I can access the website correctly.
In the public_html folder are the following files:
index.php
.htaccess
I tried to configure an .htaccess file, but I am not very experienced with that so maybe I did something wrong.
The idea is that every request like 'website.dev/users' or 'website.dev/login' is processed by the index file so I can handle the given URL. (I think that the URL: website.dev doesn't need a rewrite, because it directly leads to the index.php because it is the documentRoot)
This works fine but I noticed, when I use a rewriteRule in the .htacces file that my pages got opened called multiple times.
This is my .htaccess file:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d [OR]
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
When I comment out all the rewriteRule lines, and go to: website.dev, I see that my pages only got called once. What in the .htaccess file can cause the double page calls?
Some of the conditions aren't required.
you're testing:
is the file size > 0 OR is a symbolic link, OR is directory OR is a regular file.
I've got the below which rewrites /users/id to: index.php?url=users/id
RewriteEngine on
RewriteCond %{SCRIPT_FILENAME} !-f
RewriteCond %{SCRIPT_FILENAME} !-d
RewriteRule !\.(jpg|css|js|gif|png)$ public/ [L]
RewriteRule !\.(jpg|css|js|gif|png)$ public/index.php?url=$1
Solution:
I found the problem by looking into the apache log files, so i noticed the webserver (wamp) looked for a .ico file (wamp logo) to show in the browsers addresbar, but in my project this file did not exists, that created a 404 and so the the index file was called again, i created the needed ico file in my project folder and everything worked like a charm.

Categories