On 03/09/2010 3:50 PM, J Wilson wrote:
OK I have a somewhat related problem with the 500 error issue I was posting
about earlier today.
I originally placed these below zen cart recommended directives in my conf.d
config file for a site/domain that I am installing the newest version of
Zen-Cart – php based shopping cart. The developers claim that this file
should be left as is, if I am to receive the protections that their new
.htaccess files provide for their php scripts:
<Directory "/home/webspace/www/catalog/includes/">
AllowOverride Limit Options Indexes
</Directory>
<Directory "/home/webspace/www/catalog/zc_install/">
AllowOverride Limit Options Indexes
</Directory>
deny *everything*
<FilesMatch ".*">
Order Allow,Deny
Deny from all
</FilesMatch>
<FilesMatch ".*\.(js|JS|css|CSS|jpg|JPG|gif|GIF|png|PNG|swf|SWF)$">
Order Allow,Deny
Allow from all
</FilesMatch>
IndexIgnore */*
DirectoryIndex index.php
<FilesMatch ".*\..*">
Order Allow,Deny
Deny from all
</FilesMatch>
<FilesMatch "(^$|^favicon.ico$|.*\.(php|js|css|jpg|gif|png|html)$)">
Order Allow,Deny
Allow from all
</FilesMatch>
IndexIgnore */*
However, upon restart, Apache did not like the deny *everything* line and
Apache would not restart, so I took that one line out, restarted httpd, and the
server restarted fine.
Only problem is, the developer is now claiming that by taking that one line
out, that I may as well take the entire directive set that they recommend out
of my conf.d config file for this domain, because that one line if removed,
disables all the protections provided in their new .htaccess files that came
with Zen Cart. Funny though, I could not get his install scripts to run
without all the rest of the directives I left in.
So anyway he claims that there is a way to configure my Apache 2.2.3 server
which would make use of the deny *everything* line in my conf.d file and
provide full protection. So I am now wondering what I need to do to set the
switch to enable Apache to use this line and provide full protection.
Something in the main httpd.conf file?
He claims that this is out of the scope of their support arena, the server
settings that utilize his above suggested (actually required for install)
directives.
Thanks for any advice here.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See<URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
" from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
Hello,
*everything* is not a valid argument for the Deny directive. Please consult the official
documentation for proper usage.
Having said that, I believe that this line should be a comment to begin with, since the FilesMatch
block that follows WILL deny all requests.
Frank
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
" from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
