Web Hosting Forum | Lunarpages


*
Welcome, Guest. Please login or register.
Did you miss your activation email?


Login with username, password and session length
February 09, 2012, 06:45:19 PM

Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Another .htaccess qwestion  (Read 560 times)
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« on: September 10, 2002, 02:09:00 AM »
Can anyone tell me why this is not working?

I have a log-on script in the /adultverifier/ directory that points to /content/ directory where my .htaccess file and is the directory I want to restrict access to as such:
 

When I log in via the script (or around it!!) the content/index.html is displayed but without any images at all and like I said.. no restriction. BTW, the images are in the content/shared_images/ directory. Help!!

Here is a snippet of my .htaccess file (of course my domain for mydomain  "[Wink]" )

-----------------snip--------------------

Options -Indexes

#Error document redirect

RewriteEngine On
ErrorDocument 400 http://www.mydomain.com/avs/content/error.html
ErrorDocument 401 http://www.mydomain.com/avs/content/error.html
ErrorDocument 403 http://www.mydomain.com/avs/content/error.html
ErrorDocument 404 http://www.mydomain.com/avs/content/error.html
ErrorDocument 500 http://www.mydomain.com/avs/content/error.html

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://.+\.mydomain.com/ [NC]

RewriteCond %{HTTP_REFERER} !^http://.+\.adultverifier.com/ [NC]

RewriteRule .*[Jj][Pp][Gg]$|.*[Gg][Ii][Ff]$ http://www.mydomain.com/forbidden.html

---------------end snip------------------
Logged
So far... It seems I am my best customer.
stephan
Guest
« Reply #1 on: September 10, 2002, 06:44:00 AM »
Try taking out this bit for now, to see if it makes a difference.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://.+\.mydomain.com/ [NC]

RewriteCond %{HTTP_REFERER} !^http://.+\.adultverifier.com/ [NC]

RewriteRule .*[Jj][Pp][Gg]$|.*[Gg][Ii][Ff]$ http://www.mydomain.com/forbidden.html
Logged
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« Reply #2 on: September 10, 2002, 08:21:00 AM »
That gave me exactly what it should have. Once the new one was there I surfed to the /content/ directory (both routes) and got the index page, (no security obviously). Then typed in "frank.html" (since I don't have one) and got the "error.html" page like I should.

Now what? Before we go any further.. the directory structure above should be OK right?

Btw, I'm using WS_FTP and sending it ASCII. I get out of trouble with every bad .htaccess file by sending a blank one (htaccess_blank.txt) along with it and when the first doesn't work I merely change the name of the blank one on the server to overwrite the bad immediately. <-- for other newbies  "[Wink]"
 
 [ September 10, 2002, 04:25 PM: Message edited by: MachWon ]
Logged
So far... It seems I am my best customer.
stephan
Guest
« Reply #3 on: September 10, 2002, 02:29:00 PM »
So, if I understand you, it is working now?

Without this bit -  
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://.+\.mydomain.com/ [NC]

RewriteCond %{HTTP_REFERER} !^http://.+\.adultverifier.com/ [NC]

RewriteRule .*[Jj][Pp][Gg]$|.*[Gg][Ii][Ff]$ http://www.mydomain.com/forbidden.html

-

yeah?

I think there may be two problems.

First, putting RewriteEngine on twice might have confused it.

You probably only need it once. Have a go!

The second thing is that I don't understand your .htaccess file! It's just really confusing!
From what I can see, it makes it so that if the referrer isn't from  your domain, or adult verifier, it replaces it with nothing, which is strange...

Perhaps something like this is what you need:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?uglypeople.co.uk/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.uglypeople.co.uk/bandwidth.gif [R,L]
Logged
stephan
Guest
« Reply #4 on: September 10, 2002, 02:32:00 PM »
Ahh!

I have just worked out what your script does!

Ok!

Well, I think that you might be needing the [R,L] bit on the end of your file.

I don't know what it's for, but it might help!
Logged
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« Reply #5 on: September 10, 2002, 07:32:00 PM »
quote:
So, if I understand you, it is working now?
Well, yes.. that version, all that was left was:

Options -Indexes

#Error document redirect

RewriteEngine On
ErrorDocument 400 http://www.mydomain.com/avs/content/error.html
ErrorDocument 401 http://www.mydomain.com/avs/content/error.html
ErrorDocument 403 http://www.mydomain.com/avs/content/error.html
ErrorDocument 404 http://www.mydomain.com/avs/content/error.html
ErrorDocument 500 http://www.mydomain.com/avs/content/error.html

And it did what it was supposed to, I got re-directed to the error page if I caused one of the Document errors above.

 
quote:
The second thing is that I don't understand your .htaccess file! It's just really confusing!
From what I can see, it makes it so that if the referrer isn't from your domain, or adult verifier, it replaces it with nothing, which is strange...
Not so strange really, (I think you figured this one out  "[Wink]" ) as I understand it, the last line in the original, is to feed those, that try to enter from unauthorized places, the "forbidden.html" page. Point is, I don't want anyone outside of adult verifiers in the content directory.

 
quote:
Perhaps something like this is what you need:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?uglypeople.co.uk/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.uglypeople.co.uk/bandwidth.gif [R,L]
I tried that (with my domain info) and it worked, however, I was still able to casually surf in around the verifier script. Should I be able to after clearing cache, closing all browsers, opening one and going straight to, say.. www.mydomain.com/avs/content/stuff?

(which should be protected since it is a child directory)

I even tried another machine here.. sure, it's behind a shared connection but it had never been to the site and  nowhere in the script does it specify my IP is OK.

btw, I really do appreciate your help on this.
Logged
So far... It seems I am my best customer.
stephan
Guest
« Reply #6 on: September 10, 2002, 10:52:00 PM »
Both .htaccess files that we have tried here only block images from being "hotlinked".

You want to block *all* files yeah?

Where it says jpg | gif

add | and htm

(or php or asp if you are using it).

That way, I think it will work.

Your script seemed to search for big and small letters in the extention, e.g. Jpg, mine will only work for .jpg

but I think adding htm will work.
Logged
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« Reply #7 on: September 10, 2002, 11:27:00 PM »
Yes and no.. Here is what I really want bottom line.

- To allow all using a valid AVS password on my log-in scripts access to the /content/ file (and all children of course)

- To keep anyone from going around these scripts (i.e. typing in their browser http://www.mydomain.com/avs/content/) and seeing the /content/

- To keep anyone from hotlinking my images or pages (stealing my bandwidth) within the /content/ directory

All variations of .htaccess I have used have been straight from board examples or tutorials, subbed with my domain and particular AVS's of course  "[Wink]"

And believe me, I've used a ton of 'em.

Do you know of a better way to test them? or am I on the right track?
Logged
So far... It seems I am my best customer.
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« Reply #8 on: September 11, 2002, 03:24:00 AM »
Sorry and thanks to all that tried to help.

Found out something interesting today.. Apparently modifying and uploading .htaccess files, when you have FrontPage extensions installed, will corrupt the extensions and they must be re-installed. Hence my rather unpredictable results. (Not to mention the sudden inability to access via FP)

Thanks to support for helping me with that one.

I am currently working on a viable solution for the above scenario and hope to post some help for those of us that want our cake and eat it too.

Cheers!
Logged
So far... It seems I am my best customer.
stephan
Guest
« Reply #9 on: September 11, 2002, 04:40:00 PM »
Just put an index.htm file in the contents directory.

When people type www.mydomain/contents/

They will get www.mydomain/contents/index.htm

instead.

There is a way to do it with .htaccess, but this is a nice easy way.
Logged
stephan
Guest
« Reply #10 on: September 11, 2002, 04:45:00 PM »
The way I suggested earlier (adding htm to gif | jpg | bit) should work.

You seem to be on the right track.

Perhaps you would be better off using an FTP program to upload your files.

You can get one from www.download.com . They all have similar features, go for a free one.
Logged
MachWon
Trekkie
**
Offline Offline

Posts: 18


WWW
« Reply #11 on: September 12, 2002, 11:53:00 AM »
Thanks Stephen but that's exactly what I don't want  "[Wink]"

The point is to keep them out of /contents/ unless they have a valid AVS membership.

Also, I have found out that using an FTP prog and FP can cause problems as well.

This whole thing is really messing with my mind. I have since uninstalled FP extensions and gone with PHP for my includes. Here is the fun part. After starting from scratch I STILL CANNOT get my .htaccess files working the way they should!! AAAAARRRRG!!

I am nearly blind with rage at this point!  "[mad]"  

...Still struggling with it however.. will let you know how it turns out.
Logged
So far... It seems I am my best customer.
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to: