Forum

I have rule in lighttpd :

$HTTP["url"] =~ "^/(temp|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)/(?:$|(.*))" { url.access-deny = ( "" ) }
$HTTP["url"] =~ "^/(userfiles|pictures|design|install)(?:(.*)/$|/.+\.(tpl\.html|php|php3|php4|php5|phtml|pl|cgi))" { url.access-deny = ( "" ) }

and it works perfect.

But it doesn't work in Hiawatha

Match ^/(temp|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)/(?:$|(.*)) DenyAccess
Match ^/(userfiles|pictures|design|install)(?:(.*)/$|/.+\.(tpl\.html|php|php3|php4|php5|phtml|pl|cgi)) DenyAccess

Hiawatha doesn't start with this ?:


Hiawatha version: v9.8
Operating System: CentOS 7

I'm no regexp guru, so I have no idea what the (?:$|(.*)) part does. What is it you try to achieve?

i need to block all files of any type in that folders and subfolders

That can be done via

Match ^/(temp|smarty|sql|modules ... design|install)/ DenyAccess

for folder yes, but not for file in this folder.
I test it, and file like .../temp/index.xml accesseble

If /temp/ can also be subdirectory, simply remove the '^' at the beginning of the pattern.

for Apach this rule looks like
RewriteRule ^(temp|userfiles|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)/(.*) - [F]
RewriteRule ^(userfiles|pictures)/.+\.(php|php3|php4|php5|phtml|pl|cgi) - [F]

for Nginx
location ~* /(temp|userfiles|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)/(?:$|(.*)) {
return 403;
}

location ~* /(userfiles|pictures|design|install)(?:(.*)/$|/.+\.(tpl\.html|php|php3|php4|php5|phtml|pl|cgi)) {
return 403;
}

Without '^' at the beginning of the pattern nothing has changed. Work for folder, not for file.

Look's like a bug must work with this

Match ^/(temp|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)/($|(.*)) DenyAccess

Oo I have left,
before this rule RequestURI isfile Return

Thought it would be something like that, cause I tested it here and it works just fine.

Ok, it works with this:

Match ^/(temp|smarty|sql|modules|languages|includes|functions|fonts|files|config|classes|cache|backup)($|/.*) DenyAccess
Match ^/(userfiles|pictures|design|install)((.*)/$|/.+\.(tpl\.html|php|php3|php4|php5|phtml|pl|cgi|html|htm))$ DenyAccess

without:

RequestURI isfile Return


Thank you.

And I want to ask you, if there any differense to use: DenyAccess instead of: Redirect /
from security reason?