Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to access url: http://www.domain.com/data/images/.mthumbs/thumb-image.png

I know that this file definitely exists and correct permissions for reading: /data/images/.mthumbs/thumb-image.png

But when I view in url apache give forbidden error. Could it be because of the .mthumbs

share|improve this question
    
Just tried removing the dot from mthumbs and it works, this is definitely accusing the issue –  John Magnolia Nov 6 '13 at 8:18
add comment

1 Answer

up vote 3 down vote accepted

Such files are hidden files in linux, by convention, and security-sensitive files (.htaccess and .htpasswd in particular) begin with .. Additionally, a popular though outmoded exploit once involved putting .. in paths, and the use of /./ in paths could in some cases be used to foil access rules. For these reasons, most apache configurations tend to deny access to these files and paths.

You should have a rule somewhere that does something along the lines of:

<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

Note that it might look very little like that; it's only an example. Make sure you've covered all the security bases I mentioned earlier, and then get rid of that rule, or scope it appropriately.

By far the easier, safer, and more standard thing to do would be to amend your directory structure and/or application to not require pathnames with elements that have a leading ..

share|improve this answer
    
This is a rare case that I need to access this folder so could I take a different approach by creating a .htaccess file inside .mthumbs which overwrites the default config? –  John Magnolia Nov 6 '13 at 8:47
    
You could do that, if the appropriate AllowOverrides are set in the vhost configuration, yes. –  Falcon Momot Nov 6 '13 at 9:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.