I need to deny direct access to all folders under a certain directory (*backend) with one exception. There is one directory (*uploads) that has to be accessible through the browser.
The layout could be something like this:
*backend/
|-admin
|-system
|-themes
|-*uploads
I know you can deny all access by placing an htaccess under backend with the following:
Order Deny,Allow
Deny From All
Also, that you can override this behavior by placing a different htaccess, in this case under uploads, with:
Allow From All
This is not working, since assets under themes are not accessible to my scripts. What would be the right htaccess combo look like?
[EDIT]
I have to achieve this with htaccess, modifying the http.conf is not an option.
Modifying the htaccess such as follows, and adding one file to themes, almost has the desired result. The issue is that: files under themes have to be protected against direct access yet remain available to be served to the website.
backend
#backend
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from xx.xx.xx.xx
uploads
#uploads
Order Deny,Allow
Allow from all
themes
#themes
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from xx.xx.xx.xx
<Files *.*>
Order Deny,Allow
Allow From All #Here, I would need the files to not be accessible through browser.
</Files>