I need to deny direct access to all folders under a certain directory (*backend) with one exception. There is one directory (*uploads) that has to be accessible through the browser.
The layout could be something like this:
*backend/ |-admin |-system |-themes |-*uploads
I know you can deny all access by placing an htaccess under backend with the following:
Order Deny,Allow Deny From All
Also, that you can override this behavior by placing a different htaccess, in this case under uploads, with:
Allow From All
This is not working, since assets under themes are not accessible to my scripts. What would be the right htaccess combo look like?
I have to achieve this with htaccess, modifying the http.conf is not an option.
Modifying the htaccess such as follows, and adding one file to themes, almost has the desired result. The issue is that: files under themes have to be protected against direct access yet remain available to be served to the website.
#backend Order Deny,Allow Deny from all Allow from 127.0.0.1 Allow from xx.xx.xx.xx
#uploads Order Deny,Allow Allow from all
#themes Order Deny,Allow Deny from all Allow from 127.0.0.1 Allow from xx.xx.xx.xx <Files *.*> Order Deny,Allow Allow From All #Here, I would need the files to not be accessible through browser. </Files>