Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

First, I'm brand new to Apache .htaccess. I've got a server that must allow users to dive only into mp4 and png files. So, I've been reading Apache HTTP Server documentation and, according to what it says, I've added this to my .htaccess:

<filesMatch "\.(png|mp4)$">
Order Allow,Deny
Allow from all
</filesMatch>

because, as far as I've understood, this means "for every file, if its extension is png or mp4, allow everyone to grab it. Otherwise deny access". Obviously, I'm wrong, because this forbids me from accessing any files/folders allows me to access folders and html files (as well as of course png and mp4 files) anyway. So, how would it be to allow access only to png and mp4 files? As well, I'd like to know how to make the filter to ignore case.

Thanks.

EDIT: First - Forgot to say I need to allow localhost to access everything (i.e., the denials must be only for non-localhost). I don't really know if this is the default behaviour or is it necessary to indicate it somehow. As well, I had a corrupt file when I did the tests so that's why I was always getting 'forbidden access' to everything. I've updated the post.

share|improve this question

2 Answers 2

Try

Order Allow,Deny
<filesMatch "\.(?i:png|mp4)$">  
    Allow from all
</filesMatch>

The ?i: part should allow for case insensitive matching, and putting the order outside the FilesMatch make it deny everything not explicitly allowed.

share|improve this answer
    
Upvote for the ignore case. EDIT: I'd like to, but not yet enough reputation sorry :( –  Jorge Antonio Díaz-Benito Mar 12 '13 at 11:03
up vote 1 down vote accepted

Finally got to find the solution:

Order Deny,Allow
Deny from all
Allow from 127.0.0.1
<filesMatch "\.(?i:png|mp4)$">  
Order Allow,Deny
Allow from all
</filesMatch>

With this, I'm telling "By default, prohibit access to everything. Then if a file is PNG or MP4 type (yes, ?i: effectively ignores case), allow access to it from everywhere.

Please note that I've had to override all AllowOverride None entries in httpd.conf into AllowOverride All so that .htaccess is actually taken into account (it was being ignored before).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.