htaccess using SetEnv - newbie question

it denies access to all using SetEnv in htaccess

[bondjamesbond]

Hi,

My site is stored on two different servers at two different companies. One server stores all my images, the other all my files.

After playing around with .htaccess I have discovered that the server hosting the images does not accept mod_rewrite. So, after some searching I found this code :

SetEnvIfNoCase Referer "^http://(www\.)?mydomain\.co\.uk\" locally_linked
SetEnvIf Referer "^$" locally_linked
<FilesMatch "\.(gif¦png¦jpe?g)$">
Order Allow,Deny
Allow from env=locally_linked
</FilesMatch>

(the ¦ is actually the solid pipe character)

Now I set this up so that mydomain.co.uk is the server that contains the files. My understanding of this is that if the referrer is not mydomain.co.uk then forbid access. This then stops people typing in the URL of any the images directly on the image server.

I thought it was working great until I tried to access an image from the file server (mydomain.co.uk), but access is forbidden from that too. Have I done something wrong? Does anyone know how I can also exclude a directory from the ban - for "shared" images I might want people to have access to?

Thanks to anyone who can help.

[jdMorgan]

The trailing backslash may be causing the trouble.

Try:

SetEnvIfNoCase Referer "^http://(www\.)?mydomain\.co\.[b]uk"[/b] locally_linked

To allow a subdirectory (or any other specific condition), simply add another SetEnvIf to evaluate that condition (Request_URI in this case), and set another environment variable if true. Then add an "Allow from" directive within the <FilesMatch> container naming that environment variable. This assumes that the directory you want to "allow" contains images; If not, you'll have to rearrange the code a bit more.

Jim

[bondjamesbond]

Thanks for that Jim, I have removed that trailing slash but it doesn't appear to solve the problem. Any ideas as to what could be causing the problem?

[jdMorgan]

No, not really. A careful review of your error log and of the mod_setenvif and mod_access documentation is probably in order. For example, SetEnvIf is not fully-supported until Apache 1.3.7

Jim

[bondjamesbond]

ok, I wil have to have a closer look at the problem. Thanks Jim.