.htaccess deny all except some directories

1
votes

I have a folder that I wish to deny access to, but I wish there to be a subdirectory (and all its files and any subdirectories) that is accessible.

Sample directory structure:

/modules/
/modules/gallery/public/manifest.xml
/modules/gallery/public/js/core.js
/modules/gallery/public/css/master.css
/modules/news/public/images/status.png
/modules/news/public/css/style.css

The .htaccess file needs to be in "modules" as its subdirectories are user provided (they are plugins to a CMS), each user provided folder might have a "public" directory and only files and folders in "public" should be accessible.

1
apache.htaccess

1 Answers

5
votes

You can set an environment variable if the request contains a /public/, doing something like this in your htaccess file in the modules directory:

SetEnvIf Request_URI /public/ ispublic=1
Order Deny,Allow
Deny from all
Allow from env=ispublic

If you want to be even more restrictive, you can tweak the /public/ regex to include depth, for example, only 1 directory deep into modules:

SetEnvIf Request_URI ^/[^/]+/public/ ispublic=1