I want to allow listing (Options +Indexes) but only on a specific folder name.
The problem is that I have random folders inside a template folder and I want to allow listing only to folders named images that are under.
Is that possible with .htaccess?
In your root .htaccess place this line to disable directory listing globally:
Options -Indexes
Create images/.htaccess file and place this line:
Options +Indexes
What about using the <DirectoryMatch> directive?
It should allow you to define similar code:
<DirectoryMatch "/images/">
Options +Indexes
</DirectoryMatch>
Related
I have multiple laravel projects in my htdocs folder:
htdocs/laravelProjectA
and
htdocs/laravelProjectB
So that if i want to access a laravel route of lets say laravelProjectA the corresponding url will be:
localhost/laravelProjectA/public/myRoute
The problem is that all the laravel files and folders are inside the htdocs folder and therefore accessible to the Web, meaning that i can enter, for example:
localhost/laravelProjectA/.env
and view all the sensible data.
How can I hide all the files and folders but the public folder from each project using Apache? So that localhost/laravelProjetA/.env, localhost/laravelProjectA/.gitignore, and every request for the other files result in a 404 error, or similar.
I know i can leave only the public folder inside the htdocs folder for each project and move the other files and folders somewhere else and then change the public/index.php file, but I want to use apache to hide those files in order to have each project in a single directory.
You have to edit the /etc/apache2/apache2.conf
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
to
<Directory /var/www/>
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>
Server will stop showing files
On my Joomla 3 site (in case that's relevant), the directory /manual/images is index-able, even though it doesn't exist (there is no /manual folder in my document root. The images that are linked to it are from apache (favicons, apache logo, etc).
I've gone through the apache conf and htaccess files and set "Options -Indexes", and I've also tried removing "Indexes" from the Options entirely, with no result.
I've also tried creating the /manual/images directory and putting a .htaccess file with a deny all, but that had no impact either.
Is there a way to remove this phantom apache directory, or make it non index-able?
Try adding this rule as very first rule in your root .htaccess (just below RewriteEngine On line):
RewriteRule ^manual/images - [F,NC]
Find /etc/apache2/conf-available/apache2-doc.conf and edit this lines like this:
#Alias /manual /usr/share/doc/apache2-doc/manual/
#<Directory "/usr/share/doc/apache2-doc/manual/">
# Options Indexes FollowSymlinks
# AllowOverride None
# Require all granted
# AddDefaultCharset off
#</Directory>
I'm trying to deny users from accessing the site/includes folder by manipulating the URL.
I don't know if I have to deny everything and manually make individual exceptions to allow, if I can just deny this one folder, or if there's a rewrite function that can be used.
Specific example: I don't want to see the directory files by typing in localhost/site/includes into the URL.
Create site/includes/.htaccess file and add this line:
Deny from all
You can also deny access to a folder using RedirectMatch
Add the following line to htaccess
RedirectMatch 403 ^/folder/?$
This will return a 403 forbidden error for the folder ie : http://example.com/folder/ but it doest block access to files and folders inside that folder, if you want to block everything inside the folder then just change the regex pattern to ^/folder/.*$ .
Another option is mod-rewrite
If url-rewrting-module is enabled you can use something like the following in root/.htaccss :
RewriteEngine on
RewriteRule ^folder/?$ - [F,L]
This will internally map a request for the folder to forbidden error page.
In an .htaccess file you need to use
Deny from all
Put this in site/includes/.htaccess to make it specific to the includes directory
If you just wish to disallow a listing of directory files you can use
Options -Indexes
We will set the directory to be very secure, denying access for all file types. Below is the code you want to insert into the .htaccess file.
Order Allow,Deny
Deny from all
Since we have now set the security, we now want to allow access to our desired file types. To do that, add the code below to the .htaccess file under the security code you just inserted.
<FilesMatch "\.(jpg|gif|png|php)$">
Order Deny,Allow
Allow from all
</FilesMatch>
your final .htaccess file will look like
Order Allow,Deny
Deny from all
<FilesMatch "\.(jpg|gif|png|php)$">
Order Deny,Allow
Allow from all
</FilesMatch>
Source from Allow access to specific file types in a protected directory
You can create a .htaccess file for the folder, wich should have denied access with
Deny from all
or you can redirect to a custom 404 page
Redirect /includes/ 404.html
Just put .htaccess into the folder you want to restrict
## no access to this folder
# Apache 2.4
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
# Apache 2.2
<IfModule !mod_authz_core.c>
Order Allow,Deny
Deny from all
</IfModule>
Source: MantisBT sources.
Creating index.php, index.html, index.htm is not secure. Becuse, anyone can get access on your files within specified directory by guessing files name. E.g.: http://yoursite.com/includes/file.dat
So, recommended method is creating a .htaccess file to deny all visitors ;). Have fun !!
You can also put this IndexIgnore * at your root .htaccess file to disable file listing of all of your website directories including sub-dir
On Apache 2.4 you can use an Apache <If> expression in the root .htaccess file to block direct access to this specific subdirectory and everything within it.
For example:
<If "%{REQUEST_URI} =~ m#^/site/includes($|/)#">
Require all denied
</If>
You can do this dynamically that way:
mkdir($dirname);
#touch($dirname . "/.htaccess");
$f = fopen($dirname . "/.htaccess", "w");
fwrite($f, "deny from all");
fclose($f);
For some reasons which I did not understand, creating folder/.htaccess and adding Deny from All failed to work for me. I don't know why, it seemed simple but didn't work, adding RedirectMatch 403 ^/folder/.*$ to the root htaccess worked instead.
I don't like how if you go to certain folders on my website that don't contain a .html file that it will list all the files in it. I don't want to give access to that. Such as: http://christianselig.com/css
How do I hide these?
You need to tell your webserver to stop directory listings. For apache, add this to your httpd.conf or any other related config file
<Directory /path/to/directory>
Options -Indexes
</Directory>
If placed in a .htaccess file, AllowOverride Options must be enabled for the desired directory.
If you are using Apache webserver and have access to httpd.conf you can set "Options -Indexes" for directory which content you want to hide.
If you have no access to httpd.conf you can create .htaccess file in directory which content you want to hide with "IndexIgnore *"
I want to disable directory browsing of /galerias folder and all subdirectories
Index of /galerias/409
* Parent Directory
* i1269372986681.jpg
* i1269372986682.jpg
* i1269372988680.jpg
Create an .htaccess file containing the following line:
Options -Indexes
That is one option. Another option is editing your apache configuration file.
In order to do so, you first need to open it with the command:
vim /etc/httpd/conf/httpd.conf
Then find the line: Options Indexes FollowSymLinks
Change that line to: Options FollowSymLinks
Lastly save and exit the file, and restart apache server with this command:
sudo service httpd restart
(You have a guide with screenshots here.)
The best way to do this is disable it with webserver apache2. In my Ubuntu 14.X - open /etc/apache2/apache2.conf change from
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
to
<Directory /var/www/>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
then restart apache by:
sudo service apache2 reload
This will disable directory listing from all folder that apache2 serves.
Apart from the aformentioned two methods (edit /etc/apache2/apache2.conf or add Options -Indexes in .htaccess file), here is another one
a2dismod autoindex
Restart the apache2 server afterwards
sudo service apache2 restart
Edit/Create an .htaccess file inside /galerias with this:
Options -Indexes
Directory browsing is provided by the mod_autoindex module.
You can place an empty file called index.html into each directory that you don't want listed. This has several advantages:
It (usually) requires zero configuration on the server.
It will keep working, even if the server administrator decides to use "AllowOverride None" in the the server configuration. (If you use .htaccess files, this can lead to lots of "Error 500 - internal server error" messages for your users!).
It also allows you to move your files from one server to the next, again without having to mess with the apache configuration.
Theoretically, the autoindexing might be triggered by a different file (this is controlled by the DirectoryIndex option), but I have yet to encounter this in the real world.
One of the important thing is on setting a secure apache web server is to disable directory browsing. By default apache comes with this feature enabled but it is always a good idea to get it disabled unless you really need it.
Open httpd.conf file in apache folder and find the line that looks as follows:
Options Includes Indexes FollowSymLinks MultiViews
then remove word Indexes and save the file. Restart apache. That's it
If you choose to modify your httpd.conf file to solve this and you have multiple Options directives, then you must add a - or a + before each directive. Example:
Options -Indexes +FollowSymLinks
This is not an answer, just my experience:
On my Ubuntu 12.04 apache2, didn't find Indexes in either apache2.conf or httpd.conf, luckily I found it in sites-available/default. After removing it, now it doesn't see directory listing. May have to do it for sites-available/default-ssl.
To complete #GauravKachhadiya's answer :
IndexIgnore *.jpg
means "hide only .jpg extension files from indexing.
IndexIgnore directive uses wildcard expression to match against directories and files.
a star character , it matches any charactes in a string ,eg : foo or foo.extension, in the following example, we are going to turn off the directory listing, no files or dirs will appear in the index :
IndexIgnore *
Or if you want to hide spacific files , in the directory listing, then we can use
IndexIgnore *.php
*.php => matches a string that starts with any char and ends with .php
The example above hides all files that end with .php
Open Your .htaccess file and enter the following code in
Options -Indexes
Make sure you hit the ENTER key (or RETURN key if you use a Mac) after entering the "Options -Indexes" words so that the file ends with a blank line.
Add this in your .htaccess file:
Options -Indexes
If it is not work for any reason, try this within your .htaccess file:
IndexIgnore *
Try this in .htaccess:
IndexIgnore *.jpg
In Directory Section ( /etc/httpd/httpd.conf)
Remove Line - Options Indexes FollowSymLinks
New Line - Options FollowSymLinks
I found another way of doing this with virtual hosts:
<VirtualHost *:80>
DocumentRoot C:/WAMP/Apache24/htdocs/
ServerName vehiclesspares.com
<Directory C:/WAMP/Apache24/htdocs/vehiclesspares.com>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
This worked for me on Apache 2.4.54 on my local windows machine with the host file (C:\Windows\System32\drivers\etc\hosts) containing the line:
127.0.0.1 vehiclesspares.com
This configuration also had vehiclesspares.com under the docroot: C:\WAMP\Apache24\htdocs\vehiclesspares.com