I have a router on my index file in the root of my domain. It uses the directories supplied in the URL to require files needed for the domain. I can provide more detail on that if needed, however the application works if I don't modify the HTAccess beyond the default I started with, so I don't think so.
The PHP application handles errors, so I have the ErrorDocument pointing to my root.
Here's my current HTAccess file:
Options -Indexes
DirectoryIndex index.php
ErrorDocument 404 http://example.com/
ErrorDocument 403 http://example.com/
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{SCRIPT_FILENAME} !-d
RewriteCond %{SCRIPT_FILENAME} !-f
RewriteRule ^.*$ ./index.php
Using this, example.com/folder/directory/ successfully loads example.com/index.php, but the URL remains intact, so that my routing array has
$router->dir[0] == "folder";
$router->dir[1] == "directory";
I've tried to modify the last line to exclude some directories that users are allowed into. Let's call those /users/ and /allowed/. There aren't many of these, and never will be (hopefully), so I'd prefer to list them out. There are also dependencies directories, let's call them /js/ and /css/ for ease.
There are also directories that hold code. let's call them /code/ and /not-allowed/.
Here is the modified version I've tried, removing the conditions, because I want to control the allowed and disallowed folders and files:
Options -Indexes
DirectoryIndex index.php
ErrorDocument 404 http://example.com/
ErrorDocument 403 http://example.com/
Options +FollowSymLinks
RewriteEngine On
RewriteRule ^/((?!(users|allowed|js|css).*)$) ./index.php
This kind of works. In my previous example, example.com/folder/directory loads as a 404, so it is then routed to the index page, however the URL in the browser is changed to example.com, to it's clear that a redirect actually took place.
Removing the ErrorDocument lines, I get the default Apache 404 page, and the index.php file is not loaded.
1) is there a very simple solution? typo in my regex, maybe? I have been looking on Stack Overflow all day, and I've looked through the documentation. I can't seem to accomplish both allowing some folders and disallowing others.
2) is it smarter to allow access to everything, and then mark folders that aren't allowed? if so, how should I best go about that? do i give each of these directories their own HTAccess? I think I would prefer not to do this.
Thanks!
