CODEWITHSUNDEEP
.htaccessfile
Nick
Nick

Reputation: 1282

htaccess FilesMatch to deny but allow a specific file after

I have an htaccess rule in a folder that disallows php scripts:

 <FilesMatch "\.(?i:php)$">
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

That works just fine. The problem is that there is a specific php script I do want to be able to call (via ajax), so I want to add another rule after the deny that says "but if it is this specific file then allow it". I've done this successfully with other htaccess files in the folder that the file resides with something like this:

<Files ajax_file.php>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Allow from all
    </IfModule>
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</Files>

The problem I am having is that I want to grant a single file access from the same htaccess as the original FilesMatch that blocks all .php files. I can't seem to make it work with adding a file path and am wondering if there is a better way to go about this. The file in question would be a few folders deeper than than the htaccess file that denies the php scripts.

Upvotes: 2

Views: 7028

Answers (3)

Phill Healey
Phill Healey

Reputation: 3180

I can see that this is a really old post but, since there is no marked answer I figured I'd try and solve this.

The code you need should look like this:

<FilesMatch "\.(?i:php)$">
<IfModule !mod_authz_core.c>
Order allow,deny
Deny from all
</IfModule>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
</FilesMatch>

That blocks access to all php files and set the priority as allow then deny, so that we can override the deny all later.

Then to allow access to the specific php file use this:

<Files ajax_file.php>
<IfModule !mod_authz_core.c>
Allow from all
</IfModule>
<IfModule mod_authz_core.c>
Require all granted
</IfModule>
</Files>

I can see from your OP that this isn't that different to your own, so I can only assume that by re-adding the Order declaration you are causing some weirdness to mess things up, since you already set the priorities in the initial [block all php] files declaration.

Upvotes: 4

Amit Verma
Amit Verma

Reputation: 41249

I think mod_rewrite is the best and easiest solution to your problem.

RewriteEngine on


# allow access to ajax_file.php
RewriteCond %{THE_REQUEST} ajax_file\.php [NC]
RewriteRule ^ - [NC,L]

#disallow access to other php files
RewriteCond %{THE_REQUEST} .+\.php [NC]
RewriteRule ^ - [F,L]

Upvotes: 2

Sparkm4n
Sparkm4n

Reputation: 644

which linux distribution do you use? there are some htaccess configurators which make it easier to configure these files. you could write something like this

require valid-user

for every file that gets access.

Upvotes: 1

Related Questions