urgent htaccess help

[Rachelle1983]

Hi I need some help with a htaccess file i am working on.
I need a htaccess to allow visitors to view thumnails of pictures that have a particular suffix (eg. *thumb.jpg) but if they want to view the full picture (ie. click on the thumb) they are required to enter a username and password (the full image does not have 'thumb' in the filename)

I have searched far and wide for an answer and have come up with this so far (which doesn't work) -

AuthType Basic
AuthName "Private Stuff"
AuthUserFile /home/www.mysite.com/web/cgi-bin/passwords/.htpasswd
<Limit GET POST PUT>
require valid-user
</Limit>
<Files *thumb.jpg>
allow from all
deny from .microsoft.com
</Files>

perhaps im ordering it all wrong or the 'files' command could be nested some how, i have no idea but any help with this would be much appreciated

Thankyou

[jdMorgan]

Rachelle1983,

Welcome to WebmasterWorld [webmasterworld.com]!

"*" is not a valid wildcard character in <Files> directives, which use Regular Expressions for pattern matching. In order to use a wildcard, you will need to quote the pattern string, and use ".*" as a wildcard. A slash is required to "escape" the period in the filename, to tell the parser that it is a literal period and not a special regular-expressions character, where "." means "any character".

 <Files> ~ ".*thumb\.jpg" 

-or-

 <FilesMatch ".*thumb\.jpg" 

should accomplish what you want.

In addition, the deny,allow combination may need to be preceded by an <order> directive to accomplish your goal.

The following references may be helpful to you:

Files and FilesMatch directives [httpd.apache.org]
mod_access documentation [httpd.apache.org]
Regular expressions tutorial [etext.lib.virginia.edu]

HTH,
Jim

[Rachelle1983]

Hi jdMorgan, thankyou heaps for your welcome and reply to my question. I tried what you said and came up with the following which still isnt working properly -

AuthType Basic
AuthName "Private Stuff"
AuthUserFile /home/www.mysite.com/web/cgi-bin/passwords/.htpasswd
<Limit GET POST PUT>
require valid-user
</Limit>
<FilesMatch ".*thumb\.jpg">
Order Allow,Deny
Allow from All
Deny from www.aussiecelebs.net
</FilesMatch>

When i try to load the page with the thumbnails the htaccess is still requesting that i enter a username/password to view the _______-thumb.jpg files
I tried the links you gave me too but being a newbie they just confused me more. If you can suggest anything else i would really appreciate it.
I did notice when i tried nesting the Limit inside the FilesMatch statement it did the exact opposite to what i wanted. I couldnt view any thumbs (still kept asking for a password) but when i clicked on a the links i was able to view the full picture :/
It has to be getting close but anyway this is what i did

AuthType Basic
AuthName "Private Stuff"
AuthUserFile /home/www.mysite.com/web/cgi-bin/passwords/.htpasswd
<FilesMatch ".*thumb\.jpg">
Order Allow,Deny
Allow from All
Deny from www.aussiecelebs.net
<Limit GET POST PUT>
require valid-user
</Limit>
</FilesMatch>

Thanks

[jdMorgan]

Rachelle1983,

The Require directive works on a directory basis. It is designed to protect whole directories, and I don't think there is a work-around for this. So the "easiest" solution is to put your thumbnails in an unprotected directory, and the full-size images in a protected directory.

To avoid a bunch of work, you could move the full-size images to a protected directory, and then use mod_rewrite or RedirectMatch to "alias" the directory name to avoid having to change the directory name in the existing links which refer to these files. Here's a "map":

Filetype --- Existing Link -------------Redirect -- Actual (new) directory 
thumbnails: /image_dir/image1_thumb.jpg ---------> /image_dir/image1_thumb.jpg 
full- size: /image_dir/image1.jpg ---------------> /protected_image_dir/image1.jpg 

Maybe someone else can come up with a better solution for you.

Jim

[Rachelle1983]

i wish i could do that but the script i am using doesnt allow it. I paid $200 for the script so i dont really want to get rid of it. Thanks for your help anyway

[bcc1234]

Use either FilesMatch or LocationMatch, but include your authentication stuff ONLY for the full-size images.

Something like:
<FilesMatch "[^thumb]\.jpg$">
auth stuff here
</FilesMatch>