mod rewrite and deny from all

mod_rewrite forbidden subdirectory

[lexadev]

Hi, all.
I have some problems with mod_rewrite, Deny From All and subdirectories.

Here is folder structure of my site (it's an example):

folder1/
-.htaccess
folder2/
-somescript.php
.htaccess
index.php

in root .htaccess I have next directives:
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteRule ^.*$ index.php [L,QSA]

folder1/.htaccess contains
Deny From All

so the RewriteRule should pass all queries to index.php.
But when I try to use somthing like this http://example.com/folder1/, apache shows me 403 Forbidden message. However, when I use http://example.com/folder2/, my rule works ok.

But if i try http://example.com/folder2/somescript.php apache executes this somescript.php. I didn't expect this.

So, can somebody help me with this problem? I want to make all queries go through single index.php

[edited by: coopster at 9:07 pm (utc) on Feb. 19, 2009]
[edit reason] please use example.com, thanks! [/edit]

[jdMorgan]

Your rule shouldn't work at all -- I'd expect a server error due to internal recursion. This is because *any* requested URL-path --including "index.php"-- will get rewritten to "index.php" -- creating an "infinite" loop. The server should be detecting this, and giving up. You can easily put a stop to that:

RewriteCond $1 !index\.php
RewriteRule ^(.*)$ index.php [L]

should work better. There is no need to include [QSA], since you are not adding any new query data to the pre-existing query string. "RewriteBase /" is generally redundant, since that is the default base.

If MultiViews are enabled, then that may interfere with your rule. Try adding "-MultiViews" to your Options directive. Also, if you are on Apache 2.x, be aware that AcceptPathInfo may be interfering with your rule. Finally, "RewriteOptions inherit" may not be set on your server; Try adding that line to your code.

I'm not sure if you've considered this, but be aware that all requests for images, media, external JavaScript, sitemap.xml, labels.rdf, compact privacy policy, and robots.txt files are going to be rewritten to your script; Be sure it can handle those requests, or exclude them from the rewrite.

Jim

[lexadev]

I've added "-MultiViews" to Options directive, removed QSA, added "RewriteOptions inherit" and removed "RewriteBase /".
But result still the same.

I wondered that not forbidden folder is rewriteable by mod_rewrite.

[Caterham]

There's nothing wrong with your configuration; access runs always prior fixup, hence you get the 403. You may want to remove the access check if you expect sthg. else.

[lexadev]

Thank you for answers