The Apache 2.4 documentation mentions .htaccess as a valid context for using the <FilesMatch> directive, with, for example, a Require all denied in it.
Ref: https://httpd.apache.org/docs/2.4/en/mod/core.html#filesmatch
Yet, it leads to a 500 Internal Error if I place it in an .htaccess, and no error if I place it in the main configuration file.
However, it seems like it is less the FilesMatch directive that is a problem than the Require all denied, as no errors occurs if I leave the former empty.
Example of the block that I use:
<FilesMatch "[\._](htaccess|passwd|inf|ini|inc|cls)$">
Require all denied
</FilesMatch>
Any idea of how to make it work in the .htaccess file?
Related
Have upgraded PHP 7.4 to to PHP 8.2.1 on mac osx, and for some reason, can not locate what is causing an issue with the .htaccess file having this code in it:
Options -Indexes -Multiviews
If I remove this code the site loads, but than shows all folders and files which is not desirable. Need site to load the index.php file that is being shown here, trying to hide this, but once this is in the .htaccess file, I'm getting the following error message:
Forbidden
You don't have permission to access this resource.
Is there something in PHP that needs to be set? I did change the php_module to point to PHP 8 in the httpd.conf file, so I don't understand what else might need to change to get my localhost loaded properly instead of showing files and folders?
BTW, this was working fine on PHP 7.4, but after updating, no longer works. Maybe I have to install other modules for 8.2.1 to work correctly?
If I switch back to using PHP 7.4 everything is loading fine on the site after restarting apache.
Need site to load the index.php file
You need to set the DirectoryIndex (mod_dir) - this defaults to index.html only (an Apache issue, not PHP). It is the DirectoryIndex that determines which file(s) Apache will try to serve when requesting a directory.
For example:
Options -Indexes -Multiviews
DirectoryIndex index.php
If a DirectoryIndex document (there can be more than 1) is not found... and mod_autoindex is disabled (ie. -Indexes) then you get a 403 Forbidden response. If mod_autoindex is enabled then you naturally see a directory listing. (If mod_autoindex is not installed at all then you get a 404 Not Found.)
mod_autoindex (ie. Indexes) is not enabled by default on Apache 2.4 (it is on Apache 2.2), however, it has likely been explicitly enabled elsewhere in the server config.
My website will no longer execute an extensionless url as php anymore. I had the following in my .htaccess file which was working fine until today.
<Files pages>
ForceType x-httpd-php5-cgi
</Files>
This causes http://www.mydomain.com/pages/1/Home to run as pages/ as though it was pages.php.
Godaddy is not giving much support at this time other than indicating that they have or are updating from Apache 2.2 to 2.4.
Is it possible to do what i was doing with a rewrite rule?
Add the following lines to your .htaccess file:
Options +ExecCGI
AddHandler x-httpd-php5-3 .php
This should allow the ForceType to work properly!
F.Y.I: I had the exact same issue, so I called GoDaddy tech support, and surprisingly they were able to solve the problem. It did in fact have to do with the switch to Apache 2.4 and some changes in GoDaddy's servers.
Good Luck!
Edit:
I forgot to mention that a php5.ini file that sets cgi.fix_pathinfo = 1 is necessary!
If you are getting a "No input file specified" error, this should solve it.
This is so frustrating. My root directory is at home/websitename/websitename/ and my httpd.conf has nothing in it!
My .htaccess is in the same directory as the index.php is supposed to be and all I'm typing into .htaccess (and FTP identifies this as an HTACCESS file) is:
DirectoryIndex Home.php
The error message I get when trying to visit the site is a 403 forbidden to list the directories of "/"
the AllowOverride directive is set to All
Ok actually I made a dumb mistake.
Basically all the things one needs to check in order for the .htaccess to work are these:
Create a .htaccess file in the main directory. Make sure the .htaccess file is made in a file editor for ACSII. (notepad++, dev editor, NO Microsoft Word)
Make sure AllowOverride is set to All in the Apache configuration for your website. It should be under <directory>
Make sure to restart apache after making any changes to the Apache file!! Note that even though .htaccess does not require you to restart Apache, changing anything in the website configuration file requires you to restart Apache in order for it to function.
Lastly, your website should output a 500 Internal Apache Error if it is able to actually read the .htaccess file, NOT a 403: Access Forbidden or directory listing.
How can Apache be rewriting URLs without mod_rewrite enabled or configured?
I'm working on a site redesign from my development server. I was using a directory structure for site sections, but I am considering switching to URL rewriting and putting related files in the site's root.
For example, the about page has a subdirectory named about that contains an index.php which is served when the request is http://www.example.com/about. I plan to change this so that about.php from the site's root directory is served even if the request doesn't include the php extension.
On my development server, the problem is that the URLs are already being rewritten even though I don't have an .htaccess file anywhere along the path hierarchy.
The Apache configuration is the stock Ubuntu configuration and I suspect that it's something unique to Ubuntu, but I can't find the cause.
Here are some observations I've made:
/etc/apache2/httpd.conf is empty, but the configuration is in /etc/apache2/apache2.conf which in turn Includes config files from a few other directories.
There were no .htaccess files anywhere in the hierarchy of this site. I've checked every directory starting at /var/www
No .conf or .load files under /etc/apache2 have any reference to rewrite other than the rewrite.load file in /etc/apache2/mods-available.
I've set the LogWarning directive to debug. When I access a page without the .php extension, the error log shows the URL with the extension and the access log shows it without the extension and a HTTP 200 status. The page is served properly.
If I do add a .htaccess file with the appropriate configuration, I get an .htaccess: Invalid command 'RewriteEngine' error. ... mod_rewrite wasn't even loaded by default.
If I enable mod_rewrite by linking to the load file in /etc/apache2/mods-enabled it works as expected, which is to say exactly the same as if I didn't enable it.
access.log shows:
127.0.0.1 - - [16/Jan/2012:05:36:35 +0800] "GET /dev/ghodmode.com/h5bp/ HTTP/1.1" 200 3602 "http://alienware/dev/ghodmode.com/h5bp/experiments" "Mozilla/5.0 (Ubuntu; X11; Linux x86_64; rv:8.0) Gecko/20100101 Firefox/8.0"
while error.log shows:
[Mon Jan 16 05:23:23 2012] [debug] mod_deflate.c(615): [client 127.0.0.1] Zlib: Compressed 5347 to 1876 : URL /dev/ghodmode.com/h5bp/experiments.php, referer: http://alienware/dev/ghodmode.com/h5bp/
If I add an .htaccess file:
[Mon Jan 16 05:34:33 2012] [alert] [client 127.0.0.1] /var/www/dev/ghodmode.com/h5bp/.htaccess: Invalid command 'RewriteEngine', perhaps misspelled or defined by a module not included in the server configuration, referer: http://alienware/dev/ghodmode.com/h5bp/experiments
Update
Thanks to answers provided, I've been reading and I've learned a few things. The gist of it is that I'm using a stock Ubuntu installation of Apache2 and I haven't changed any configuration settings from the default. So, none of the suggested causes are set.
Of course there is the chance that I've misunderstood some of the documentation. This is the first time I've read about some of these options.
Multiviews
Multiviews provides the best explanation of this scenario, but that requires a type map or MultiViews option set for a path. I only have one type map (/etc/apache2/mods-enabled/mime.conf) for 'var' and the MultiViews option is only set for /usr/share/apache2/icons. So, this couldn't be it.
Redirect & RedirectMatch
Redirect & RedirectMatch would provide a good explanation for this behavior, but it requires a directive for each redirection. I don't have any of these set and any path that I type serves the related php file if it exists. Also, if this was the cause, I think that the access.log would generate a 3xx status instead of 200 if it was a redirect.
Alias & AliasMatch
Alias & AliasMatch, like Redirect & RedirectMatch, requires a directive to be set for each resource. I only have an alias set for /icons/.
FallbackResource
FallbackResource identifies a single resource to serve when the requested resource isn't present. In my case, when the requested resource isn't present it serves the resource found by appending '.php' to the end of the request. I also double-checked and there are no FallbackResource directives set.
Here's an example of the command I use to confirm that there a particular option isn't set anywhere:
find /etc/apache2 -name "*.conf" -exec grep -li "FallbackResource" {} \;
Update #2:
There was a hole in my search for the MultiViews option. I was only looking for files with a .conf or .load extension, but some of the configuration files don't have an extension at all. The MultiViews option is set by the default site configuration file /etc/apache2/sites-enabled/000-default.
Thanks to #zneak for providing the answer first, although he did it in a comment. And thanks to #regilero who indirectly showed me what I was missing by using a different syntax for grep from the syntax I'm used to.
What you call a rewrite can be done by a lot of others instructions:
Redirect & RedirectMatch : for external redirection (with 301,302 or even 403 or 404 codes
Alias & AliasMatch : for internal redirection (internal directory re-mapping for example)
FallBackresource : to redirect every missing file to an index.php boostrap
Option Multiviews : from mod-autoindex which is enabled by default on a lot of installations
Theses configuration things are usually not in .htaccess files by default, as .htaccess files is just a bad thing slowing down apache and allowing user to add some other rules than the one defined in VirtualHosts. Most usefull configuration stuff is in /etc/apache2/sites-enabled, /etc/apaches2/mod-enableds/ and /etc/apache2/conf.d/.
Now the strangest one is Option Multiviews make a grep -R MultiViews /etc/apache2/*. This option will map any call to http://www.example.com/foo/bar to foo/bar.php or foo/bar.html if theses directories exists in the DocumentRoot and if theses files exists (trying on all available extensions).
I have pushed my .htaccess files to the production severs, but they don't work. Would a restart be the next step, or should I check something else.
A restart is not required for changes to .htaccess. Something else is wrong.
Make sure your .htaccess includes the statement
RewriteEngine on
which is required even if it's also present in httpd.conf. Also check that .htaccess is readable by the httpd process.
Check the error_log - it will tell you of any errors in .htaccess if it's being used.
Putting an intentional syntax error in .htaccess is a good check to make sure the file is being used -- you should get a 500 error on any page in the same directory.
Lastly, you can enable a rewrite log using commands like the following in your httpd.conf:
RewriteLog "logs/rewritelog"
RewriteLogLevel 7
The log file thus generated will give you the gory detail of which rewrite rules matched and how they were handled.
No:
Apache allows for decentralized management of configuration via special files placed inside the web tree. The special files are usually called .htaccess, but any name can be specified in the AccessFileName directive... Since .htaccess files are read on every request, changes made in these files take immediate effect...
From the apache documentation:
Most commonly, the problem is that AllowOverride is not set such that your configuration directives are being honored. Make sure that you don't have a AllowOverride None in effect for the file scope in question. A good test for this is to put garbage in your .htaccess file and reload. If a server error is not generated, then you almost certainly have AllowOverride None in effect.
Only if you have not added the mod_rewrite module to Apache.
You only need to restart Apache if you change any Apache ".conf" files.
I have the same issue and it seems PiedPiper post about AllowOverride were most helpful. Check your httpd.conf file for "AllowOverride" and make sure it is set to All.
In case of .htaccess restart is not required if it is not working probable reasons include.
AllowOverride May not be set which user can set inside httpd.conf or might have to contact server admin.
Check the file name of .htaccess it should be .htaccess not htaccess.txt see here for guide how to create one.
Try to use Options -Indexes or deny all kind of simple directive to see if it is working or not.
clear browser cache everytime if having rule for redirects or similar if previous redirect is cached it appears as if things are not working.
What's in your .htaccess? RewriteRules? Check that mod_rewrite is installed and enabled.
Other stuff? Try setting AllowOverride to 'all' on that directory.