block media in a directory

mod_rewrite HTTP_REFERER

[troot]

hi all,

I have the following settings I'm trying to get to work:
RewriteEngine on
ErrorDocument 403 /tmp/err.html
RewriteLogLevel 9
RewriteLog "c:/reflog.log"
RewriteCond %{HTTP_REFERER}!^$ [OR]
RewriteCond %{HTTP_REFERER}!^http://localhost/*\.php$ [NC]
RewriteRule /locked_down/*(.jpg¦.jpeg¦.gif¦.png¦.swf)$ - [F]
Can anybody give any suggestions on how to get it working properly? The required functionality is, if somebody requests any of the specified media, but it isn't coming from a php page on my site, send a forbidden message.

I know it is possible to circumnavigate this method and it has one or two other flaws, but I believe it will do for my purposes.

Troot

[jdMorgan]

troot,

Welcome to WebmasterWorld!

First, remove the [OR] from the first RewriteCond. You want the rule applied if the Referrer is non-blank AND non-local. If it is blank, you can't tell where the request came from, and many legitimate requests will be blank.

The syntax in the rule's pattern is incorrect. mod_rewrite uses regular expressions, not 'windows wildcards'. In this case "/*" means "match zero or more slashes here." See our forum charter for a link to more regular expressions information.

RewriteRule /locked_down/*(.jpg¦.jpeg¦.gif¦.png¦.swf)$ - [F]

I suspect that you want "/.+" instead.

Jim