Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've inherited a poorly designed web app, which has a certain file that needs to be publicly accessible, but that file is inside a directory which should not.

In other words, I need a way to block all files and sub-directories within a directory, but over-ride it for a single file.

I'm trying this:

# No one needs to access this directly
<Directory /var/www/DangerousDirectory/>
   Order Deny,allow
   Deny from all

   # But this file is OK:
   <Files /var/www/DangerousDirectory/SafeFile.html>
      Allow from all
   </Files>
</Directory>

But it's not working- it just blocks everything including the file I want to allow. Any suggestions?

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

There is an answer on StackOverflow that should answer this question, I think there is a missing Order in the nested Files directive?

http://stackoverflow.com/questions/6243677/apache-how-to-deny-directory-but-allow-one-file-in-that-dirctory

share|improve this answer
    
Thanks for pointing that out. That answer didn't exist when I asked this question. :) –  Nick Apr 6 '12 at 15:27
add comment
# No one needs to access this directly
<Directory /var/www/DangerousDirectory/>
   Order Deny,allow
   Deny from all
</Directory>
# But this file is OK:
<Files /var/www/DangerousDirectory/SafeFile.html>
   Order Deny,Allow
   Allow from all
</Files>

And if this directory is password-protected, add Satisfy any too.

share|improve this answer
    
I still seem to be getting a 403 message on the file? –  Nick Aug 26 '10 at 10:06
    
Oops, wrong Order order. See httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order –  Lekensteyn Aug 26 '10 at 10:31
    
Still not having much luck with this. :/ –  Nick Aug 26 '10 at 17:46
    
Do you have a .htaccess file in /var/www/DangerousDirectory/ with something like Deny from all? –  Lekensteyn Aug 26 '10 at 17:53
    
There's an .htaccess but everything has been commented out. –  Nick Aug 27 '10 at 6:08
show 3 more comments

A very late answer, but still perhaps an answer.

The tag is in the scope of the directory and should not have the full path. So it should read:

<Directory "/var/www/DangerousDirectory">
   Order Deny,allow
   Deny from all

   # But this file is OK:
   <Files "SafeFile.html">
      Allow from all
   </Files>
</Directory>

Be aware that this would allow any file called SafeFile.html in that directory-tree.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.