.htaccess blocks urls that contain a dot

Question

I have this .htaccess file

DirectoryIndex index.php
RewriteEngine On

RewriteBase /



########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
## Deny access to extension xml files (uncomment out to activate)
#
#Order allow,deny
#Deny from all
#Satisfy all
#
## End of deny access to extension xml files
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a  tag in URL
RewriteCond %{QUERY_STRING} (\|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]
#
########## End - Rewrite rules to block out some common exploits

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/index.php
RewriteCond %{REQUEST_URI} (/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$  [NC]
RewriteRule (.*) index.php
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

I don't know why, but if i have a dot in the url, the server shows Url Not Found error instead of redirecting me to the index.php.

I would like to enable urls with dot, how can i do it?

claustrofob claustrofob · Accepted Answer · 2013-06-03T14:59:00

In this rule

RewriteCond %{REQUEST_URI} (/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$

this part /[^.]* blocks any dots in request URI. Try to remove it or set to /[^/.]+

Seems like this rule (/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*) was intended to allow only urls with a limited set of extensions [.php, .html, .htm, .feed, .pdf, .raw]. But the last part of it /[^.]* seems wrong. It checks if after slash there is any symbol except dot. But the rule [^.] may contain also slashes. I suppose that the intention of that part was to allow also urls without dots in the last section. So i suggested you to use /[^/.]+.

As you want to use dots at any position it is the same like to allow any extension. So This line does not make sense at all.

.htaccess blocks urls that contain a dot

1 Answers