.htaccess RewriteCond %{REQUEST_FILENAME}
I have a folder in my web root called docs and I need to ensure that files in this directory cannot be accessed by non authenticated users.
I have a file in this directory called index.php that verifies whether the user is logged in and serves up the requested file accordingly.
So in order to catch requests for files, in docs I have created the following .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !index.php
RewriteRule ^(.*)$ index.php?requested_file=$1 [QSA,L]
</IfModule>
This works if I navigate to /docs/index.php then index.php is called. However if I navigate to /docs/cat.jpg then I am sent directly to cat.jpg. But I shouldn't be able to access this file...
Can anyone advise what I am doing wrong here please?
apache .htaccess nginx
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
|
show 1 more comment
I have a folder in my web root called docs and I need to ensure that files in this directory cannot be accessed by non authenticated users.
I have a file in this directory called index.php that verifies whether the user is logged in and serves up the requested file accordingly.
So in order to catch requests for files, in docs I have created the following .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !index.php
RewriteRule ^(.*)$ index.php?requested_file=$1 [QSA,L]
</IfModule>
This works if I navigate to /docs/index.php then index.php is called. However if I navigate to /docs/cat.jpg then I am sent directly to cat.jpg. But I shouldn't be able to access this file...
Can anyone advise what I am doing wrong here please?
apache .htaccess nginx
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
1
Are you usingapacheornginx?
– Richard Smith
Nov 13 '18 at 16:14
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
1
Ok, but.htaccessis an Apache configuration file. It will have absolutely zero effect on your Nginx server.
– Richard Smith
Nov 13 '18 at 16:23
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
It doesn't sound like your.htaccessfiles is being processed at all. Remove the<IfModule>wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?
– MrWhite
Nov 13 '18 at 17:04
|
show 1 more comment
I have a folder in my web root called docs and I need to ensure that files in this directory cannot be accessed by non authenticated users.
I have a file in this directory called index.php that verifies whether the user is logged in and serves up the requested file accordingly.
So in order to catch requests for files, in docs I have created the following .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !index.php
RewriteRule ^(.*)$ index.php?requested_file=$1 [QSA,L]
</IfModule>
This works if I navigate to /docs/index.php then index.php is called. However if I navigate to /docs/cat.jpg then I am sent directly to cat.jpg. But I shouldn't be able to access this file...
Can anyone advise what I am doing wrong here please?
apache .htaccess nginx
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
I have a folder in my web root called docs and I need to ensure that files in this directory cannot be accessed by non authenticated users.
I have a file in this directory called index.php that verifies whether the user is logged in and serves up the requested file accordingly.
So in order to catch requests for files, in docs I have created the following .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !index.php
RewriteRule ^(.*)$ index.php?requested_file=$1 [QSA,L]
</IfModule>
This works if I navigate to /docs/index.php then index.php is called. However if I navigate to /docs/cat.jpg then I am sent directly to cat.jpg. But I shouldn't be able to access this file...
Can anyone advise what I am doing wrong here please?
apache .htaccess nginx
apache .htaccess nginx
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
edited Nov 13 '18 at 17:47
Jay Blanchard
35.6k125495
35.6k125495
asked Nov 13 '18 at 15:53
ShaunShaun
61
asked Nov 13 '18 at 15:53
ShaunShaun
61
asked Nov 13 '18 at 15:53
ShaunShaun
61
61
1
Are you usingapacheornginx?
– Richard Smith
Nov 13 '18 at 16:14
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
1
Ok, but.htaccessis an Apache configuration file. It will have absolutely zero effect on your Nginx server.
– Richard Smith
Nov 13 '18 at 16:23
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
It doesn't sound like your.htaccessfiles is being processed at all. Remove the<IfModule>wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?
– MrWhite
Nov 13 '18 at 17:04
|
show 1 more comment
1
Are you usingapacheornginx?
– Richard Smith
Nov 13 '18 at 16:14
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
1
Ok, but.htaccessis an Apache configuration file. It will have absolutely zero effect on your Nginx server.
– Richard Smith
Nov 13 '18 at 16:23
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
It doesn't sound like your.htaccessfiles is being processed at all. Remove the<IfModule>wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?
– MrWhite
Nov 13 '18 at 17:04
1
1
Are you using
apache or nginx?– Richard Smith
Nov 13 '18 at 16:14
Are you using
apache or nginx?– Richard Smith
Nov 13 '18 at 16:14
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
1
1
Ok, but
.htaccess is an Apache configuration file. It will have absolutely zero effect on your Nginx server.– Richard Smith
Nov 13 '18 at 16:23
Ok, but
.htaccess is an Apache configuration file. It will have absolutely zero effect on your Nginx server.– Richard Smith
Nov 13 '18 at 16:23
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
It doesn't sound like your
.htaccess files is being processed at all. Remove the <IfModule> wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?– MrWhite
Nov 13 '18 at 17:04
It doesn't sound like your
.htaccess files is being processed at all. Remove the <IfModule> wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?– MrWhite
Nov 13 '18 at 17:04
|
show 1 more comment
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53284754%2fhtaccess-rewritecond-request-filename%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53284754%2fhtaccess-rewritecond-request-filename%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Are you using
apacheornginx?– Richard Smith
Nov 13 '18 at 16:14
I am using nginx locally and apache on the live server
– Shaun
Nov 13 '18 at 16:21
1
Ok, but
.htaccessis an Apache configuration file. It will have absolutely zero effect on your Nginx server.– Richard Smith
Nov 13 '18 at 16:23
Thanks Richard, however this isn't working on the server either
– Shaun
Nov 13 '18 at 16:53
It doesn't sound like your
.htaccessfiles is being processed at all. Remove the<IfModule>wrapper (you don't need it) - do you get an error? If not, try typing nonsense in the file - do you get an error?– MrWhite
Nov 13 '18 at 17:04