Non-existing file/URL returns 403 Forbidden - apache

Going to example.com/config or example.com/account/login returns 403 Forbidden.
In reality, /config and /account/login should be redirected to index.php but it gives 403.
My directory structure is like this:
/var/www/example
└─/assets
└─/bower_components
└─/node_modules
└─/partials
└─/templates
└─/tests
└─/vendor
└─index.php
This is my Virtual host configuration:
<VirtualHost *:80>
ServerName example.com
DocumentRoot /var/www/example
<DirectoryMatch "^/var/www/example/(?!(assets|partials))\w+">
Require all denied
</DirectoryMatch>
<Location />
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [QSA,L]
</Location>
</VirtualHost>
I want to disallow access to every folder except assets and partials, that's why I added that DirectoryMatch directive.
I use a PHP framework called Slim so I have to add Location and Rewrite directives.
I think Apache thinks my URLs are directories and blocks them. Is there a way to unblock my URLs?

Try adding:
<Directory "/var/www/example">
Order Allow,Deny
Allow From all
</Directory>
above the <DirectoryMatch> container in your vhost config.
Since you're using apache 2.4, then use require all:
<Directory "/var/www/example">
Require all granted
</Directory>

If you're using Apache 2.4 try to add in the end of your VirtualHost:
<Directory /var/www/example>
Options Indexes FollowSymLinks MultiViews
# If you want to enable overrides, you should read:
# http://httpd.apache.org/docs/2.0/mod/core.html#allowoverride
AllowOverride All
Require all granted
Satisfy Any
Order allow,deny
Allow from all
</Directory>

Related

Prevent Apache for opening files with similar name to url

My .htaccess:
RewriteEngine On
RewriteBase /
RewriteCond %{REQUESTFILENAME} !-f
RewriteCond %{REQUESTFILENAME} !-d
RewriteRule ^login/generic_oauth$ auth0-callback.php [L]
RewriteRule ^(.*)$ index.php?page=$1 [L]
My vhost file:
<VirtualHost *:443>
DocumentRoot /home/blabla/www/frontend/
ServerName some-domain.net
ServerAlias www.some-domain.net
SSLEngine on
SSLCertificateFile /etc/apache2/crt/cert.pem
SSLCertificateKeyFile /etc/apache2/crt/key.pem
<Directory />
Options -Indexes +FollowSymLinks -MultiViews
AllowOverride All
Require all granted
</Directory>
<Directory /home/blabla/www/>
Options -Indexes +FollowSymLinks -MultiViews
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
The problem is when I try to access https://www.some-domain.net/login/generic_oauth Apache is loading login.php (which exists). Problem disappears when I rename the file to loggin.php for example.
The problem is when I try to access https://www.some-domain.net/login/generic_oauth Apache is loading login.php (which exists). Problem disappears when I rename the file to loggin.php for example.
This problem is symptomatic of having MultiViews enabled. Although, you appear to be disabling MultiViews in the server config, except that you are not targeting the DocumentRoot with your <Directory> containers...
DocumentRoot /home/blabla/www/frontend/
:
<Directory />
Options -Indexes +FollowSymLinks -MultiViews
AllowOverride All
Require all granted
</Directory>
<Directory /home/blabla/www/>
Options -Indexes +FollowSymLinks -MultiViews
AllowOverride All
Require all granted
</Directory>
You should not be setting AllowOveride All and Require all granted in the <Directory /> container, ie. the entire drive! You should be disabling access instead and this should already be defined outside of the <VirtualHost> container, in the main server config.
You are then granting access to /home/blabla/www/, but this is the directory above the DocumentRoot?! Do you have another .htaccess in this parent directory? Do you have another <Directory> container that matches the DocumentRoot?
So, your config should look more like this:
<Directory />
Options SymLinksIfOwnerMatch
AllowOverride None
Require all denied
</Directory>
<VirtualHost *:443>
ServerName some-domain.net
ServerAlias www.some-domain.net
SSLEngine on
SSLCertificateFile /etc/apache2/crt/cert.pem
SSLCertificateKeyFile /etc/apache2/crt/key.pem
DocumentRoot /home/blabla/www/frontend/
<Directory /home/blabla/www/frontend>
Options +FollowSymLinks
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
As with any changes to the server config, you need to restart Apache.
If this does not resolve the issue then you need to look for any other places in the config that could be enabling MultiViews. And if all else fails, explicitly disable MultiViews in the .htaccess file itself:
Options -MultiViews

How to add a subpath to root url on Apache

I'm using Apache 2.4 (on a Drupal 7/Docker project).
I want my all my site pages to map from /var/www/html to http://domain/foo/ (eg: /var/www/html/1/2/3/ to http://domain/foo/1/2/3/)
I prefer to avoid using .htacess and only apache conf file
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
ServerName foo_name
# Try 1
Alias /foo /var/www/html
# Try 2
Redirect "/" "/foo/"
<Directory /var/www/html>
DirectoryIndex index.php
Options Indexes FollowSymLinks
AllowOverride All
AllowOverride None
Order Allow,Deny
Allow from All
# Try 3
RewriteEngine On
RewriteBase /foo
To do so I tried :
Alias : Alias /foo /var/www/html so I can access to my front page with http://domain/foo/ but it doesn't work on http://domain/foo/1/2/3/). And also it's just a one way redirection.
Redirect Redirect "/" "/foo/" : I did not worked on my bowser I try to acces to http://domain/foo/ but I got this url (almost infinite loop) http://domain/foo/foo/foo/foo/foo/foo/foo/foo/foo/...
RewriteBase : RewriteBase /foo but it doesn't work probably because I need to match it with htacess on subdirectory.
Most advanced rewriting : I saw a lot of them on StackOverflock/ServerFault but it did'nt seem appropriate for my problem (I never use before regex PCRE, harder to adapt). Moreover I should avoid using rewrite for that case.
It's working like that (alias + RewriteRule) :
Alias /foo /var/www/html
<Directory /var/www/html>
DirectoryIndex index.php
Options Indexes FollowSymLinks
AllowOverride All
AllowOverride None
Order Allow,Deny
Allow from All
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

Laravel 4 home redirecting to www.ipaddress and failing

My current .htaccess file looks like this:
<IfModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
</IfModule>
I have laravel 4 installed on an ubuntu 14.04 distribution.
My apache.config file looks like this:
<Directory />
Options FollowSymLinks
AllowOverride All
Require all denied
</Directory>
<Directory /usr/share>
AllowOverride None
Require all granted
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
And my 000-default.config is as follows:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/public
<Directory /var/www/public>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
Laravel's installed in /var/www
What I experience however is that when I try to navigate to the IP of the site (no domain attached). I get redirected to www.ip_address
for example 178.1.2.3 would have me redirect to www.178.1.2.3.
Mod_rewrite is enabled. So I have no idea why this is happening.
Could anybody help?
Thanks
If it's redirecting, so it's not rewrite problem, the problem with redirecting.
If You navigate to: http://178.1.1.1 and as result You're in http://www.178.1.1.1 so it means in Your code somewhere redirection happens.
it's not apache issue, it's in laravel app code.
To prove it You can put in /var/www/public/index.php after <?php:
die($_SERVER['REQUEST_URI']);
it will show You that web server rewrites properly.
You've to find such code where it redirects and comment it.
Normal app must not redirect to www.HOSTNAME, redirection must be in web server level, not in app level.

Trying to do hidden redirect with .htaccess - redirect is visible

I am trying to set something up on my local server where if I go to mydomain/docs it does a redirect internally to mydomain/slate/build, but have the user still see mydomain/docs in their browser's url. I have it half working - when I go to mydomain/docs, it loads the correct index.html in /slate/build but the issue is that my url bar:wq shows mydomain/slate/build when the desired url is mydomain/docs.
Here is my entire .htaccess file that does the redirect:
RewriteEngine on
RewriteRule ^/?docs$ /slate/build [L]
And here is what I believe to be potentially relevant from my apache2.conf:
HostnameLookups Off
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf
<Directory />
Options Indexes FollowSymLinks Includes ExecCGI
AllowOverride All
Require all granted
Allow from all
</Directory>
<Directory /usr/share>
AllowOverride None
Require all granted
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
AccessFileName .htaccess
<FilesMatch "^\.ht">
Require all denied
</FilesMatch>
IncludeOptional conf-enabled/*.conf
IncludeOptional sites-enabled/*.conf
And finally my VirtualHost in sites-enabled:
<VirtualHost mydomain>
DirectoryIndex index.html
ServerAdmin postmaster#dummy-host.localhost
DocumentRoot /correct/file/structure
ServerName mydomain
ServerAlias mydomain
</VirtualHost>
Yes it is - it's a directory with an index.html in it, which is the file I'm trying to pull up.
Since it's a directory, you need to end the URI with a slash, otherwise mod_dir will kick in an redirect the browser to the same URI but with a trailing slash. Try changing your rule to:
RewriteEngine on
RewriteRule ^/?docs$ /slate/build/ [L]

.htaccess deny from all doesn't work

my problem is that I want to deny the access to a folder but I can't.
I've put a .htaccess file in this folder with just these lines:
order deny,allow
deny from all
Any idea of what can be happening?
I get it! It was due to the apache configuration. In my foo.conf of sites-avaiables directory I had:
AllowOverride None
As apache doc says, AllowOverride Description: Types of directives that are allowed in .htaccess files
When it is changed to:
AllowOverride All
it works perfectly!
You can also configure it with specific options:
AllowOverride directive-type
directive-options at: apache.org
I had the same issue using that method. Try this instead:
RewriteEngine On
RewriteCond %{REQUEST_URI} foldername
RewriteCond %{REMOTE_ADDR} !^111\.222\.333\.44$
RewriteRule . - [R=404,L]
With this method you need to add your own ip.
Options: instead of the last line being a 404 page not found:
RewriteRule . - [R=404,L]
you can change it to a 403 forbidden:
RewriteRule .*? - [F]
or redirect to your homepage:
RewriteRule . http://www.domain.com/ [R,L]
you need to do two things,first, change the conf of apache to allow override,
second, to change the conf of a hosting to allow override
first
nano /etc/apache2/apache2.conf
<Directory /var/www/html/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
and change it to;
<Directory /var/www/html>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
Second
cd /etc/apache2/sites-available
nano yourdomain.com.conf
add the following codes into it,
<Directory "/var/www/html/yourdomain.com/public_html">
AllowOverride All
Require all granted
</Directory>
after adding
<VirtualHost *:80>
ServerAdmin support#yourdomain.com
ServerName yourdomain.com
ServerAlias www.yourdomain.com
DocumentRoot /var/www/html/yourdomain.com/public_html/
<Directory "/var/www/html/yourdomain.com/public_html">
AllowOverride All
Require all granted
</Directory>
Use this:
<Directory /folder_name>
Order Deny,Allow
Deny from all
</Directory>
Its better to add a rule to allow your ip address. You can use allow from your_ip_address for this. Be careful with the ip address as it can be shared. You can check your ip address using http://www.whatismyip.com/