Deny access to specific file types in specific directory

by

The FilesMatch directive works purely on filenames. It doesn’t look at the path portion at all.

If you want to specify directives in the root .htaccess file to control a subdirectory, you can use mod_rewrite.

Try this:

RewriteRule ^uploads/.*\.(php|rb|py)$ - [F,L,NC]

The above will block any filename ending in .php or .rb or .py in the /uploads directory or its subdirectories. For example, it will block:

  • /uploads/something.php
  • /uploads/something/more.php

Note that there is no leading slash in the rewrite rule. The path that you need to use in the directive will be different depending on where it’s placed. The above directive, if placed in the document root’s .htaccess file, will work for files in a directory called uploads that is directly beneath document root.

While the above answers your question, it would be safer to allow only specific files rather than trying to block files. Often a server will execute files with extensions other than the ones you’ve listed.

You could do something like this:

RewriteCond %{REQUEST_URI} ^/uploads [NC]
RewriteCond %{REQUEST_URI} !\.(jpe?g|png|gif)$ [NC]
RewriteRule .* - [F,L]

With the above, if the request URI begins with /uploads but does not end with one of the specified extensions, then it is forbidden. You can change the extensions to whatever suits your needs. But that way, you can permit extensions as needed rather than finding out too late that you missed blocking one.

This rule (from your question)

RewriteRule ^(uploads/\.php) - [F,L,NC]

will block

  • /uploads/.php
  • /uploads/.phpmore

but it does not allow for anything between the directory name and the file extension.

If you are going to use rewirte rules, you might want to learn more about regexp. I often refer to www.regular-expressions.info when I need to look up something.

More Related Contents:

  1. How do I find files that do not contain a given string pattern?
  2. Check if any type of files exist in a directory using BATCH script
  3. How to find the largest file in a directory and its subdirectories?
  4. How do I find the current directory of a batch file, and then use it for the path?
  5. Comparing folders and content with PowerShell
  6. How can I get the list of files in a directory using C or C++?
  7. Directory-tree listing in Python
  8. Copying files from one directory to another in Java
  9. What is double dot(..) and single dot(.) in Linux?
  10. In MATLAB, can I have a script and a function definition in the same file?
  11. Ant task to run an Ant target only if a file exists?
  12. How do you get a directory listing in C?
  13. Script to associate an extension to a program
  14. Trying to copy file from one XP PC to another using WMI, since RPC and UNC are not available
  15. How to read/write from/to a file using Go
  16. How to delete a folder with contents using PHP [duplicate]
  17. How can I find encoding of a file via a script on Linux?
  18. for IE gives full path, need file name only
  19. Force download of ‘data:text/plain’ URL
  20. Find files in a folder using Java
  21. Printing the last column of a line in a file
  22. Log4Net config in external file does not work
  23. How do I detect when a directory or file changes without constant scanning
  24. Determining Whether a Directory is Writeable
  25. Find all CSV files in a directory using Python
  26. How to check if a directory/file/symlink exists with one command in Ruby
  27. Whats the default path for static files in Angular2?
  28. split file on Nth occurrence of delimiter
  29. count files in specific folder and display the number into 1 cel [closed]
  30. Method to get all files within folder and subfolders that will return a list

Leave a Comment