Deny from all in subdirectory htaccess not overriding file rules in root htaccess

前端 未结 2 1531
無奈伤痛
無奈伤痛 2021-01-11 13:05

I\'ve got a situation where I\'m trying to deny access to all files in a subdirectory of my website. I have added an htaccess file to this subdirectory and added a deny fro

相关标签:
2条回答
  • 2021-01-11 13:29

    Order of directives in apache is really not obvious.

    You have a complete description of it on the documentation "How the sections are merged".

    Here is an excerpt:

    The order of merging is:

    • <Directory> (except regular expressions) and .htaccess done simultaneously (with .htaccess, if allowed, overriding <Directory>)
    • <DirectoryMatch> (and <Directory ~>)
    • <Files> and <FilesMatch> done simultaneously
    • <Location> and <LocationMatch> done simultaneously
    • <If>

    So what happens is that your <File> directive is handled after the Directory ones (as a .htaccess is in fact a Directory directive for the current directory).

    It works in your given exemple as theses files directives are in fact nested in the .htaccess Directory directives, and the second File directive is applied after the parent directory one.

    You cannot use a <FileMatch> directive in the parent, where files from the subdirectory would be excluded, as fileMatch is only working on the file name, and not on the file path. But you could maybe try with a LocationMatch, but it would maybe end in a quite complex one, to forbid also location hacks with dots.

    In fact the solution I would use here is a RedirectMatch in the parent folder:

    RedirectMatch 403 ^.*\.html$
    
    0 讨论(0)
  • 2021-01-11 13:47

    You can have your Root .htaccess like this

    # Deny access to everything by default
    Order Deny,Allow
    deny from all
    
    # Allow access to html files
    <Files *.html>
        allow from all
    </Files>
    
    # Deny access to sub directory
    <Files subdirectory/*>
        deny from all
    </Files>
    

    There is no need for a separate .htaccess in the sub directory.

    You are allowing access to all html files in your .htaccess in the Root Directory and not denying it anywhere in the sub directory in the first case. Apache parses all your rules and uses the last matching rule, unlike firewalls (which uses the first rule match hit). The global rules are read first and the the specific rules later.

    0 讨论(0)
提交回复
热议问题