.htaccess Redirect request to files exts in particular folder only

Question

Hi. How do you write rules to redirect all requests to *.php and *.html files in upload/ folder to a text file name forbidden.txt in root www folder. What I'm trying to do exactly is preventing script execution in this dir by redirecting those requests to the text file

Note: The upload/ folder is accessibly by ftp used by a group of people to upload files so I cannot place htaccess inside this folder.

Answer 1

Put your htaccess rules in httpd.conf instead.

Answer 2

If you can't edit httpd.conf, then your best bet is to not allow web access to that directory at all. Let FTP users access a folder outside of your web directory and then provide a mechanism for retrieving the file contents.

You could name that directory "upload". Then you could have your .htaccess file make requests to /upload/myfile execute upload.php, which finds ../upload/myfile and spits backs its contents. This way it would appear to users that they are accessing the "upload" folder directly, but you would the level of control you want through the PHP script.

Answer 3

Create an .htaccess file at the root level of your site containing

RedirectMatch ^/upload/.+(html|php)$ http://www.yoursite.com/forbidden.txt

You could also try switching off the PHP engine in that directory by creating an .htaccess file in /upload/ containing:

php_value engine off

although you would need to ensure that people cannot upload files with the name .htaccess