Deny, Allow for protect my data .

Protect and deny except .css .jpeg .png . gif & index.php & directory ...

[leandre]

Hello,

Actualy, im use this :

Order Deny,Allow
Deny from all
Allow from 10.1.10.2
<Files ~ ".(css¦jpe?g¦png¦gif¦js)$">
Allow from all
</Files>
<Files ~ "index.php">
Allow from all
</Files>

It's work but it's doesnt work for :

example.com/data/
example.com/data/test/

I view 403 Forbiden

but if i write :
example.com/data/index.php it's work
example.com/data/index.php it's work

Do you have any idea for view 200 for the directory ?
example.com/data/ & example.com/data/test/ ect

In my index.php i have this :
<?php header('HTTP/1.1 404 Not Found'); ?>

I search for scriptkidies, is think my directory is doesnt exist. And this for all subdirectory.

Best regards

Sorry for my english

[leandre]

Or it's possible to send 404 for all document is not Allow ?
I read a documentation, i think is not possible but maybe im wrong ?

[Caterham]

Which version of apache do you use?

[leandre]

Im use apache 2

I find a solution but is dirty :
#Order Allow,Deny
Order Deny,Allow
Deny from all
Allow from 10.5.10.4
#<Files ~ "index.php">
#Allow from all
#</Files>
<Files ~ ".(css¦jpe?g¦png¦gif¦js)$">
Allow from all
</Files>
ErrorDocument 403 /page.html

/page.html is doesnt exist and now all is send 404 except *.css .jpg *.jpeg ect

But for you is dirty lol do you have best idea ?

[Caterham]

2.0 or 2.2? There are differences between these versions. You can issue a 404 with mod_rewrite since vers. 2.2, and with some sort of ugly workaround also in all prior versions (rewriting to a non-existent file which triggers a 404).

[leandre]

Oh sorry for me is same :(

Im use : Apache 2.2.10

[Caterham]

ok, so you could use

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule !(?:^¦index\.php¦/¦\.(?:css¦jpe?g¦png¦gif))$ - [R=404]

to 404 everything except .css .jpeg .jpg .png . gif index.php and "directory" if REMOTE_ADDR is not 10.1.10.2

You have to replace the ¦ character with a solid one from your keyboard and the module mod_rewrite must be enabled, of course. The expression does not handle the case if a directory was requested without the trailing slash.

[leandre]

Ok thank you, im search exactly that :)

But when im use your rule is send always time 404 if remote addresse is not 10.1.10.2 for .css .jpeg .jpg .png . gif index.php and "directory"

And when im use 10.1.10.2 is send 200 for .css .jpeg .jpg .png . gif index.php and "directory".

Do you have any idea ;) ?

[Caterham]

Did you replace all pipes ¦ with solid ones?

[leandre]

Oups sorry.

Big thank you, your solution is very very very nice.
This is not dirty :))))

I have last question :

I search send to 404 everything except for 10.1.10.2

And i write two rule, please tell me is for you is dirty ;)

#Allow only 10.1.10.2
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule $ - [R=404]

#Allow only 10.1.10.2 for login.php
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule (?:login\.php)$ - [R=404]

My rule is work, but for you is dirty or is good :)

Thanks
Best regards,

[Caterham]

> RewriteRule $ - [R=404]

I'd use ^ instead of $, but without looking at the source of PCRE I think $ should return true immediately, too.

If you know where your login.php is located, specify the path, i.e. starting with the ^ anchor marking the begin of the string. You don't need the non-capturing parenthesis since you cont have a more complex "or" structure ('¦' stands for "or" in the rule above).
If the file is in your root folder

RewriteRule ^login\.php$ - [R=404]

if somewhere else

RewriteRule ^folder/foo/login\.php$ - [R=404]

[leandre]

Thank you ;)

But sorry i have last question :

Actualy i have 4 sub-directory :

/my-content/
/misc/
/admin/
/toto/

In my /my-content/ i have .htaccess witch this :
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule !\.(?:css¦jpe?g¦png¦gif¦js)$ - [R=404]
ErrorDocument 404 /page-404

In my /my-content/ i have .htaccess witch this :
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule !\.(?:css¦jpe?g¦png¦gif¦js)$ - [R=404]
ErrorDocument 404 /page-404

In my /admin/ i have .htaccess witch this :
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule $ - [R=404]
ErrorDocument 404 /page-404

In my /toto/ i have .htaccess witch this :
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule !\.(?:html)$ - [R=404]
ErrorDocument 404 /page-404

In my root directory i have .htaccess witch this :
RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule !(?:^¦sitemap\.xml\.gz¦robots\.txt¦index\.php¦/¦\.(?:css¦jpe?g¦png¦gif¦js))$ - [R=404]

RewriteCond %{REMOTE_ADDR} !=10.1.10.2
RewriteRule (?:login\.php)$ - [R=404]

ErrorDocument 404 /page-404

But maybe, a very beautiful solution i have only one .htaccess in my root directory ?
It's possible ?