Zen Cart Logo
Forums / Basic Configuration / Download folder in Web Root - preventing direct access to files

Download folder in Web Root - preventing direct access to files

Views: 1,889

Results 1 to 4 of 4
3 Apr 2015, 10:14 PM
#1
nigelt74 avatar

nigelt74

Totally Zenned

Join Date:
Sep 2005
Location:
Waikato, New Zealand
Posts:
1,558
Plugin Contributions:
1

Download folder in Web Root - preventing direct access to files

Ok we are moving hosts and the new host doesn't appear to allow folders anywhere but the webroot

Previously we had the downloads folder below the webroot and had redirect on.

All i want to do is prevent direct download from the download folder below is the current .htaccess file, but it doesn't seem to prevent direct access at all

#
# @copyright Copyright 2003-2011 Zen Cart Development Team
# @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
# @version $Id: .htaccess 18695 2011-05-04 05:24:19Z drbyte $
#

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
#Require valid-user


###############################
#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified. 
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

Failing that is there any need for the download folder to be called "download" if i were to change the name of it and the links to it in my config files would that offer some protection?

Thanks

3 Apr 2015, 10:50 PM
#2
nigelt74 avatar

nigelt74

Totally Zenned

Join Date:
Sep 2005
Location:
Waikato, New Zealand
Posts:
1,558
Plugin Contributions:
1

Re: Download folder in Web Root - preventing direct access to files

Ok, I think it is working and this is probably only relevant to my hosting situation

I had to go into my hosting control panel and click a link that says "sync .htaccess" to get the .htaccess to work, from what i understand i have to do this whenever i alter an .htaccess file

3 Apr 2015, 10:59 PM
#3
lhungil avatar

lhungil

Totally Zenned

Join Date:
Feb 2012
Location:
mostly harmless
Posts:
1,818
Plugin Contributions:
4

Re: Download folder in Web Root - preventing direct access to files

Deleted

4 Apr 2015, 9:56 AM
#4
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,711
Plugin Contributions:
56

Re: Download folder in Web Root - preventing direct access to files

Be sure to try an actual test of a file in your download directory using the URL of that file (to be sure it doesn't work).