Download area / Redirect to php file = Error 403

Redirecting all requests to a php script

[Garfield]

Hi,

I want to build a secure download area on a website I'm currently working on. My idea is this:

All requests are redirected to a php script, that increments a counter and then opens the requested file.
I pass the requested file as a variable.

My .htaccess looks like this:

RewriteEngine On
RewriteRule /downloads/stories/([^/\?]*) /downloads/stories/download.php?file=$1

When I try to access a file in downloads/stories/ I always get an error 403 message.

What is wrong with my .htaccess? phpinfo() tells me mod_rewrite is compiled in, so I guess it is working in general. When I add "Options +FollowSymLinks" I even get a internal server error...

My php script is also working, just mod_rewrite gives me a real headache...

btw.: How would I have to write the rewriterule when I wanted the .htaccess file to be in the /downloads/stories/ directory?

Thanks for any help!

[jdMorgan]

Garfield,

Welcome to WebmasterWorld [webmasterworld.com]!

If you look at your rule, you'll see that you have a recursion problem, since any request for the script will be redirected... to the script, which will be redirected... to the script.
You'll need to add a RewriteCond ahead of your RewriteRule:

RewriteCond %{REQUEST_URI} !^/downloads/stories/download\.php

Jim

[Garfield]

Thank you for your answer, but I still get the same error.

I don't think it's a recursion problem, because I don't redirect to the requested file in the php script. The script sends an application/zip header and then the file itself.

It would be nice if you (or anyone) could help me with this issue, because I really don't understand why it doesn't work.

Thanks!

[jdMorgan]

The redirect itself is recursive, because your php script matches the rule. Therefore, it will redirect to itself.

Every time a request is handled, whether internal or external, your .htaccess files may be processed if they are in the path to any resource which is being requested or checked. So that means that even after your rule is invoked, .htaccess may be re-processed. In that case, you'll get a loop. For example, if your script does any checks for "file or directory exists", .htaccess will be re-processed.

You may not have permission to use mod_rewrite on your server, so try a simple test first:

RewriteEngine on
RewriteRule ^silly\.html$ http://www.yourdomain.com/ [R=301,L]

Request "silly.html" with your browser, and you should be served the default page for your site.

If not, check your error log - it often will tell you what is wrong.

Jim

[Garfield]

The rewrite engine works now, but I still have a little problem I can't seem to solve by myself.

My .htaccess now looks like this:

Options +FollowSymLinks
RewriteEngine on
#RewriteCond %{REQUEST_URI}!^download\.php
RewriteRule ([^/\?]*) download.php?file=$1

My problem is, that the initially requested file isn't passed to the php script. All I get is the string 'download.php'. But this isn't what I wanted.

How can I get the initially requested file passed as a parameter to the php script?

Thanks!

[jdMorgan]

Please say why you used the bolded pattern below. What specifically do you want to match as the requested filename?

 RewriteRule [b]([^/\?]*)[/b] download.php?file=$1 

As written, it says, "match any number of any characters up until you find a slash, a backslash, or a question mark, and then stop building the back-reference."

The question mark part is suspicious, since you'll never get one there; query strings are stripped out and loaded into a separate variable, so "?" will never appear there.

Jim

[Garfield]

I want to get the filename, that was initially requested from the server, before it was redirected to the download.php.

This filename is supposed to be passed as a parameter to the download.php. Just like this: download.php?file=$1.

Seems like I got me regex totally wrong... ;)
Basically I need to get the filename of the request stripped of all path components.

Thanks a lot!

[jdMorgan]

Options +FollowSymLinks
RewriteEngine on
RewriteCond %{REQUEST_URI} !^download\.php
RewriteRule /?(.*)$ download.php?file=$1 [L]

$1 will be everything following the last slash in the requested URI, or everything in the URI if no slash is present.

Jim

[edited by: jdMorgan at 5:37 pm (utc) on Mar. 5, 2004]

[Garfield]

It's still not working the way you suggested. I don't understand why, but I always get 'download.php' as the filename, which is clearly wrong and not what I want.

I have no clue what to do about this, it's driving me crazy.

If I'm not mistaken the URI would look like this:

/temp/downloads/stories/whatever

and this is supposed to be transformed into

download.php?file=whatever

When I checked the regex you gave me in a nice tool called "The Regex Coach", it gave me back the whole URI. I have no idea if it's correct, since Apache always returns download.php, but I honestly don't understand those regular expressions.

[jdMorgan]

OK, making the rule most specific for the path you've given, here's my final attempt:

Options +FollowSymLinks
RewriteEngine on
RewriteCond %{REQUEST_URI} !download\.php$
RewriteRule ^temp/downloads/stories/(.*)$ download.php?file=$1 [L]

The code above should have worked, but I had copied your commented-out RewriteCond, which would put you back into recursion mode.

If this does not work when installed in your Web root directory, then I don't know what's wrong. Your test of the regex coach indicates that it does not properly understand anchoring rules, so don't put too much stock in it.

Jim

[Garfield]

THANK YOU SO MUCH!

It finally works now! This is kind of a release for me, thank you for your time you put in your answers!

Cheers