0

I have a subdomain that has index.php at its root. What I want is to block access to https://SUB.example.com/index.php or any other top files while letting anyone with a full URL to access to files (like another index.php in a subfolder of that subdomain)

I would like to do this under my virtualhost config instead of .htaccess because the same folder is used by another subdomain.

I am using Apache 2.4 under Debian Buster

1

There are several ways to limit the access to a certain path, but here's one example:

Make use of the <Location> tag. For example:

<VirtualHost "*:80">
    DocumentRoot "/path/to/blah"
    ServerName blah.blah.blah
    <Location "/somepath">
        Require all denied
    </Location>
</VirtualHost>

You could also use the Redirect option in the location, if you want to point the client somewhere more informational:

Redirect 403 /somepath /some-nice-message.html
  • The issue is this. I want to block /index.php but not /index.php/apps/somepage – yarun can Jul 2 at 3:46
  • use LocationMatch with a regex that only matches what you're looking for. – TheCompWiz Jul 2 at 19:24
1

Use the LocationMatch directive, which allows specifying a regular expression as a location, like this:

<VirtualHost *:80>
    ServerName your.server.name
    (...)
    <LocationMatch "^/[^/]*">
       Require all denied
    </LocationMatch>
</VirtualHost>

This will block all access which begins with a /, but does not contain any / signs, so anything in the webroot will be blocked, but any path under that will be allowed. Parameters are not considered part of the path, so calling /index.php?/blah will be denied as well.

However, if AcceptPathInfo is On or Default, then paths like /index.php/blah will be accepted, and will result in parsing the php file (in fact, any scripts which have handlers accepting PATH_INFO requests will be served this way). If it is not what you want, then you might want to disable AcceptPathInfo, but that may result in misbehaving PHP pages. A better solution is explicitly denying php files in the root directory (this config snippet should be used after the one above):

<LocationMatch "^/[^/]*\.php.*">
    Require all denied
</LocationMatch>
  • Thanks I will test this one too. – yarun can Jul 2 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.