停止.htaccess重写受保护目录中的文件

Question

This is the regular TYPO3 RealURL .htaccess in a nutshell, situated in public_html:

# * BASIC TYPO3 URL REWRITING *
# -----------------------------
RewriteRule ^typo3$ - [L]
RewriteRule ^typo3/.*$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule .* index.php

It will redirect incoming links that do not start with typo3, that are not files, directories or symlinks to the central entry point index.php.

Now we have a .htaccess/httpauth protected directory called public/user_upload/myDir.

Its .htaccess file contains only the following lines:

AuthUserFile "/home/user/.htpasswds/public_html/fileadmin/user_upload/myDir/passwd"
AuthType Basic
AuthName "Please authenticate"
require valid-user

Accessing a file www.mysite.com/public/user_upload/myDir/myfile.pdf from that directory is impossible as long as the main .htaccess redirections are enabled.

Instead of displaying the httpauth-login-dialogue, which is the desired outcome, the RewriteRule to index.php still applies.

So I would like to exclude that directory from rewriting, by adding the following line:

# * BASIC TYPO3 URL REWRITING *
# -----------------------------
RewriteRule ^typo3$ - [L]
RewriteRule ^typo3/.*$ - [L]
// stop rewriting if myDir is accessed
RewriteRule ^public/user_upload/myDir/.*$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule .* index.php

Sounds good, but doesn't work. The Rewriting still goes to index.php. What could be the reason?

It's as if !-d couldn't detect the directory. Maybe because it's protected?

Answer 1

I realized my question was actually about a conflict between mod_rewrite and htpasswd. Googling with these terms, I found https://www.drupal.org/node/33645, leading to https://serverfault.com/questions/55323/disable-mod-rewrite-for-subdirectory and http://www.myriadinteractive.com/blog/view/id/29/conflict-between-apache-url-rewriting-and-basic-authentication

For basic authentication, the server writes a "401 Unauthorized" header and then looks for an error document based on a pre-defined path. Most of the time, the error document won't exist in the directory that you want to protect, so the request gets handled by the rewrite engine which throws a 404 error.

The solution is simple: return a 401 and turn off mod_rewrite in the protected directories.

So each of those .htaccess files had to be edited as such:

# new
ErrorDocument 401 "Unauthorized Access"
RewriteEngine off

# as before
AuthType Basic
AuthName "MyName"
AuthUserFile "/home/mysite/.htpasswds/public_html/my/path/"
require valid-user