Disable mod_rewrite for subdirectory

Question

I'm running a CMS using mod_rewrite for pretty URLs, but I have another site running in a subdirectory under the CMS that requires URL rewriting disabled, so I added a couple lines in the .htaccess file:

Options -MultiViews
Options +ExecCGI

AddHandler php5-cgi .php
Action php-cgi /cgi-bin/php-wrapper.cgi
Action php5-cgi /cgi-bin/php-wrapper.cgi

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# Added following two lines
RewriteCond %{REQUEST_URI} ^/dir/
RewriteRule ^(.+) - [PT,L]

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d     
RewriteRule ^(.*)$ index.php/$1 [L]
</IfModule>

This works, HOWEVER one of the directories under /dir/ is protected using mod_auth and is still being rewritten. If I take out the Require valid-user directive in the .htaccess file for this directory, everything works great.

Here is the .htaccess file from the protected directory:

RewriteEngine off

AuthType Basic
AuthName "Administration"
AuthUserFile "/home/user/admin/.htpasswd"
require valid-user

Any help would be appreciated. This has been bugging me for weeks! I did some Googling and others have had this problem, but I haven't found a solution.

Answer 1

I had the same problem, Michael, and finally found the solution

For basic authentication, the server writes a "401 Unauthorized" header and then looks for an error document based on a pre-defined path. Most of the time, the error document won't exist in the directory that you want to protect, so the request gets handled by the rewrite engine which throws a 404 error.

The solution to this problem is pretty straightforward. You need to add a single line of code to your .htaccess file instructing Apache to ignore the error document. When you're done, the code should look something like this:

ErrorDocument 401 "Unauthorized Access"

RewriteEngine off

AuthType Basic
AuthName "Administration"
AuthUserFile "/home/user/admin/.htpasswd"
require valid-user

Hope that works for you!

Answer 2

I'd try to enclose the Rewrite statements into a <DirectoryMatch> statement next. You could simply use it with inverse logic to match every directory but the one that should not be rewritten:

<DirectoryMatch "^/(?!dir)">
    RewriteEngine on
    ...
</DirectoryMatch>

Answer 3

Alternatively to Manni:

RewriteCond %{REQUEST_URI} !^/dir/
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d     
RewriteRule ^(.*)$ index.php/$1 [L]

and ditch the two rules you added (assuming I've understood the problem correctly), and remove the RewriteEngine from the protected .htaccess.