Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to protect user uploaded files in directory /secret. I created a htaccess file and placed it into that directory.

RewriteBase /secret/
RewriteCond %{REQUEST_URI} !^download.php.*$
RewriteRule .* download.php [QSA,L] #send request to php script, that script sends out the file if user is authenticated

This is working very well, as long as all the files are in that /secret directory. The problem comes when there are subdirectories, for example /secret/subfolder/document.txt. Now when I request this file with my browser, Apache sends out the file. It will not be rewritten by the rewriterule, and anyone can download that file.

Is there any trick that I could use to redirect all the request inside /secret folder to go throught download.php script? So that /secret/file.txt and /secret/subfolder/document.txt etc would all work. I can do the authentication only with php and I would like to keep my directory structure as it is, since those files are used as links on a various member only pages.

Best regards, Jdoen

share|improve this question

1 Answer 1

up vote 0 down vote accepted
RewriteBase /secret/
RewriteCond %{REQUEST_URI} !^download.php.*$
RewriteRule ^(.*)$ download.php [QSA,L] #send request to php script, that script sends out the file if user is authenticated

If that doesn't work try to remove the ^ in front of ^(.*)$

share|improve this answer
    
Thanks for your quick reply. I feel a bit stupid now, since the problem was that there was another .htaccess file in the subdirectory. Your suggestion works perfectly. But just to let others know, my original rewriterule was also actually working. –  Jdoen Dec 7 '10 at 13:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.