Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to deny direct access to all folders under a certain directory (*backend) with one exception. There is one directory (*uploads) that has to be accessible through the browser.

The layout could be something like this:

*backend/     
  |-admin    
  |-system    
  |-themes    
  |-*uploads

I know you can deny all access by placing an htaccess under backend with the following:

Order Deny,Allow
Deny From All

Also, that you can override this behavior by placing a different htaccess, in this case under uploads, with:

Allow From All

This is not working, since assets under themes are not accessible to my scripts. What would be the right htaccess combo look like?


[EDIT]

I have to achieve this with htaccess, modifying the http.conf is not an option.

Modifying the htaccess such as follows, and adding one file to themes, almost has the desired result. The issue is that: files under themes have to be protected against direct access yet remain available to be served to the website.

backend

#backend
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from xx.xx.xx.xx

uploads

#uploads
Order Deny,Allow
Allow from all

themes

#themes
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
Allow from xx.xx.xx.xx
<Files *.*>
    Order Deny,Allow
    Allow From All #Here, I would need the files to not be accessible through browser.
</Files>
share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

Try this in your httpd.conf (or similar configuration file)

<Location /backend>
    Order deny,allow
    deny from all
</Location>

<Location /backend/uploads>
    Order allow,deny
    allow from all
</Location>

In case you need access to /backend from your server itself you could additionally add the following line in the first paragraph above deny from all.

allow from 127.0.0.1, <server-ext-ip>

One more thing. The order of the paragraphs is important, just in case.

share|improve this answer
    
This is basically the same setup I had, except that would be placed in the httpd.conf. The IP line was helpful, thou. You got an up-vote, thanks. –  goliatone Dec 6 '11 at 12:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.