How to write duplicated "RewriteCond"

IP restriction for some dir, and free for the others

[three star123]

Hi, webmasters and developers

I am going to open the site that includes admin-pages and
user pages.
Page uri is like as following.

User Pages : http://www.example.com/...
Admin Pages : http://www.example.com/admin/...
http://www.example.com/install/...

I want to restrict IP range for only administrative pages.
The following htaccess script is for my site.
In reference, My site is running on Zend Framework 1.8.

--------------------------------------------------------
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
--------------------------------------------------------

Please show me how to write .htaccess script for
restriction above.

Best regards.

[edited by: jdMorgan at 10:09 pm (utc) on June 17, 2009]
[edit reason] example.com [/edit]

[g1smd]

You might find a

Rewrite_Cond

looking at

REMOTE_ADDR

will help you here.

We can help you debug your code, but there are not enough volunteers to provide a free write-code-for-you service.

[three star123]

Thanks you, g1smd.

I found the solution.
I allowed to access to admin pages from 192.168.15.121, 122.
I want to help the developers for this script.

----------------------------------------------------
RewriteCond %{REMOTE_ADDR} !^192\.168\.15\.121$
RewriteCond %{REMOTE_ADDR} !^192\.168\.15\.122$
RewriteCond %{REQUEST_URI} ^.*\/(admin¦install)\/.*$ [NC]
RewriteRule .* /error-403.php

RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
--------------------------------------------------------
Thanks. Good day!

[jdMorgan]

In order to invoke a proper 403-Forbidden status response, you must use the [F] flag:

RewriteCond %{REMOTE_ADDR} !^192\.168\.15\.121$
RewriteCond %{REMOTE_ADDR} !^192\.168\.15\.122$
RewriteRule ^(admin¦install)/ - [F]

Replace the broken pipe "¦" character with a solid pipe before use; Posting on this forum modifies the pipe characters.

Jim

[three star123]

Thanks, jdMorgan.

Your reply helped me with my .htaccess setting.
I have more problems.

-----------------------------------------------------------
RewriteCond %{HTTP_USER_AGENT} ^.*(MSIE¦Firefox¦Safari¦Opera¦Chrome).*$ [NC]
RewriteCond %{REQUEST_URI} !^.*\/(admin¦install)\/.*$ [NC]
RewriteRule ^.*$ - [F,L]
-----------------------------------------------------------

Script above is for blocking access to mobile pages from PC-browser.
Mobile pages are ones besides following.
http://www.example.com/dir/admin
http://www.example.com/dir/install

Mobile pages are like as;
http://www.example.com/dir/{sub paths}

But, the script doesn't bring to me any affect.
I think that the reason is because of (!)negative sign.

Please show me how to correct the script.

Best regards.

[g1smd]

[F] always implies [L]

Removing unnecessary escaping and redundant patterns:

RewriteCond %{HTTP_USER_AGENT} (MSIE¦Firefox¦Safari¦Opera¦Chrome) [NC] 
RewriteCond %{REQUEST_URI} !(admin¦install)/ [NC] 
RewriteRule . - [F]

Be aware that Opera make one of the most widely used Mobile Browsers on the planet, so you might need to review your list again.

[jdMorgan]

... and Safari-mobile is used with the iPhone and iPod
... and Chrome is based on Safari, and so the Chrome user-agent string contains "Safari"

Jim

[three star123]

Thanks, for your kind pointing.
I will check Browser agents' list again.

>> [F] always implies [L]
>>
>> Removing unnecessary escaping and redundant patterns:
>>
>> RewriteCond %{HTTP_USER_AGENT} (MSIE¦Firefox¦Safari¦Opera¦Chrome) [NC]
>> RewriteCond %{REQUEST_URI} !(admin¦install)/ [NC]
>> RewriteRule . - [F]

I confirmed that [F] always implies [L].
And I tried with script above, but the negative sign(!) seems to be not working correctly yet.
If I deleted sign(!), the script would be working correctly, but inversely.
I think the key of resolution is in sign(!).

I am finding the resolution and looking forward your help.
Best regards.

[jdMorgan]

The "local or" character (shown here as "¦" and called a pipe) is often problematic. Posting on this forum modifies that character, and makes it wrong. The characters must be a solid, unbroken vertical line.

Jim

[three star123]

jdMorgan, I know a pipe sign(¦) and solid pipe sign.
I use solid pipe lines in my script.

Anyway, I have one suggestion.
How about skipping over ( RewriteRule .* - [F] ) line using [S=*] option?

---------------------------------------------------
RewriteCond %{HTTP_USER_AGENT} (MSIE¦...¦...) [NC]
RewriteRule (admin¦install) - [S=1] # If pc, skip blocking line and go to next lines.
RewriteRule .* - [F]

... some other scripts
---------------------------------------------------

However, I don't know about [S] option well.
Please teach me.

[jdMorgan]

g1smd posted the correct code above. If it does not seem to work, then something else is wrong. Make sure you completely flush or delete your browser cache before testing any new code.

Jim

[three star123]

jdMorgan, I tried again after deleting caches, but it's same.
I write the whole content of .htaccess file here.

------------------------------------------------------
RewriteEngine on

# IP restriction for administrative pages
RewriteCond %{REMOTE_ADDR} !^192\.168\.25\..*$
RewriteCond %{REQUEST_URI} ^.*\/(admin¦install¦default)\/.*$ [NC]
RewriteRule ^.*$ - [F]

# Browser restriction for mobile pages
RewriteCond %{HTTP_USER_AGENT} (MSIE¦...¦...¦...) [NC]
RewriteCond %{REQUEST_URI} (admin¦install¦default) [NC]
RewriteRule .* - [S=1]
RewriteRule .* - [F]

# General rule for Zend Framework
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule .* - [NC,L]
RewriteRule .* index.php [NC,L]
------------------------------------------------------

IP restriction is working correctly.
I think the script for Zend FW is also correct.
Could you check script for browser restriction, please?

Best regards.