I want to deny direct access to some sensitive files in my root application (e.g: log,sh, ini ...etc). and for this reasons I have used the following directive in my main .htaccess:
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|bak|md|txt|lock|phar|bat)$|action.bat|composer.json|VERSION.*"> Require all denied </FilesMatch>
the wierd thing is that it work perfectly fo all files listed in the FileMatch except files with (.bat) extention, which I did not figure yet whythey still downloadable using direct URL access. Configuration:
- OS: Windows 10
- Stack: XAMPP
XAMPP components version:
- Apache 2.4.39
- MariaDB 10.1.38
- PHP 7.3.4 (VC15 X86 64bit thread safe) + PEAR
- phpMyAdmin 4.8.5
- OpenSSL 1.1.0g
- XAMPP Control Panel Version 3.2.3.
actually I discover that the Pattern Matching works with all ".bat" files except the ones with name "action" ! if I change the name to anything else (lets say "action1" ) it works just fine.