views:

974

answers:

2

Hello,

I have problem with getting the folder inc restricted.

It is only the inc folder in the root directory and not the inc folders higher up de hiarchie

Problems are:

  1. IE will start a download/open dialog and

  2. FF displays an include file

I don´t have this problem with the images folder wich is also in the root directory.

What logic could I use to prevent this, please?

 Options +FollowSymlinks
RewriteEngine On
Options All -Indexes
IndexIgnore *
# RewriteRule ^inc($|/) - [R=403,L]
RewriteCond %{HTTP_REFERER} !^http://([-a-z0-9]+\.)?taxi-bel\.nl [NC]
RewriteRule \.(gif|png|jpg|css|js)$ - [F,NC,L]
#
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteRule ^(.*)$ index.php?url=$1 [QSA,L]
#
RewriteCond %{HTTP_HOST} ^www\.(.*) [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,NC,L]

Edit because

I solved the problem by adding this rule DirectoryIndex index.php

and to place an index.php in the inc folder wich points to an error file , - or you can make it the error page itself -, and problem solved!

thanks, Richard

+1  A: 

The rule you commented out can do that:

RewriteRule ^inc($|/) - [F,L]

And I would rather send a 404 than a 403. But this requires Apache 2.

Gumbo
Thanks, but you gave me that yesterday. If I use that one my css dissapears, or if I apply it to images folder, my images dissapear.
Richard
@Richard: Well then I don’t get what you want.
Gumbo
To block include files from direct outside access, in the same way as it is working now for the images folder. It is not possible to see a listing off files for that folder. And that´s is what my question is about. Why does it not work for the include folder. And I can see different output in the two browsers with the same rules. If you could try it, you can see for yourself.
Richard
@Richard: Testing the Referer header field is not reliable since some browsers omit it for security reasons.
Gumbo
Thank you #Gumbo, is there an alternative? Also, can you maybe think why the inc folder is acting weird. It is what is bothering me the most right now.
Richard
+1  A: 

If you only want to disallow accessing the inc folder and its contents via the webserver ayou can simply put a .htaccess file in the inc folder itself and disallow all accesses from outside.

Order deny, allow
deny from all
bluebrother
no, that diddn´t work it blocks everything for the pages also
Richard
Well, then you might want to refine your question. Do you want to block all accesses to the inc folder from outside (i.e. only allowing access from scripts running on the server)? If you do you could block the whole folder in the way described, but be aware that you need to put that htaccess file inside the folder you want to block access to, not in the folder containing it.
bluebrother