.htaccess help

[Nuklear]

Hey people, I've been struggling with this recently. How do I restrict access to all .php files except the .php files in a certain folder: ajax?

I'm making a Facebook app and I've allowed access to all .php files from Facebook servers. However, the ajax calls aren't executed through Facebook so users are unable to execute ajax files.

Thanks in advance.

Love,
Nuklear

 

[Technikawesome]

Hey people, I've been struggling with this recently. How do I restrict access to all .php files except the .php files in a certain folder: ajax?

I'm making a Facebook app and I've allowed access to all .php files from Facebook servers. However, the ajax calls aren't executed through Facebook so users are unable to execute ajax files.

Thanks in advance.

Love,
Nuklear

Outside:

php_flag engine off

Inside:

php_flag engine on

Doc

Untested.

 

[Nuklear]

That won't work because it will prevent the Facebook server from executing the scripts.

All I need is a way to throw a 403 error whenever a .php script is executed except by a certain IP. I can do this but it also applies to the ajax directory. Whenever I put in "Allow from all" in a .htaccess folder in the ajax directory, it doesn't work.

 

[Technikawesome]

Try adding a check in PHP files outside the ajax directory:

if ($_SERVER['REMOTE_ADDR'] != '...') die ('HACKING ATTEMPT');

 

[Nuklear]

Many of my files already have something similar to that. But, it'll be alot easier if I can just control it with .htaccess.

Thanks for the help though.

---------- Post added at 12:10 PM ---------- Previous post was at 12:08 PM ----------

Many of my files already have something similar to that. But, it'll be alot easier if I can just control it with .htaccess.

Thanks for the help though.

 

[s-p-n]

Edited(2):

- Throw an .htaccess file in the folder you wish to secure.

- In the file, write:

Order Deny,Allow
deny from all
allow from facebook.com

- I believe that should work, if not, I did it incorrectly, so check this:
http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/#sec7

 

[Nuklear]

When I added the following in the .htaccess file in the root directory:

<Files ~ "\.php">
Order deny,allow
deny from all
Allow from 69.63
</Files>

It doesn't even seem to make any changes. However, it worked for other files such as .ini, etc.

EDIT:
I found an useful article that helped me.
http://stackoverflow.com/questions/1340001/deny-direct-access-to-all-php-files-except-index-php

 

[Superfun]

Im getting a way different thing from google

<Files ~ "\.(php)$">
Order deny,allow
deny from all
Allow from 69.63
</Files>

 

[Nuklear]

Yes, that's what I have and it works. But, when I put this in a .htaccess file in the ajax directory

<Files ~ "\.(php)$">
Order deny,allow
Allow from all
</Files>

It doesn't even work. I can't execute the ajax script.

 

[s-p-n]

In the directory you want secure,
do

#Server Access Only
deny from all

In the AJAX directory,
do

#Anyone Access Anything
allow from all

My logic was backward last time. I thought you wanted to allow facebook only, but if you want it for everyone, it's much easier.