Search code examples
.htaccessdirectory-listing

Use htaccess to redirect root but still have directory listing accessible with a backdoor

What I thought I was trying to do was genius, but it seems to not work properly.

I have a public subdomain with temp files on it. I don't want people to be able to see all the files listed when they visit it. I don't want to password protect it because that will mess up several scripts when fetching files off the server, and I don't want a blank index.html there to stop listing because I want to be able to see the listing.

So my stroke of genius was to have a .htaccess file like so:

RewriteEngine On
RewriteCond %{REQUEST_URI} !/#dir
RewriteCond %{REQUEST_URI} !/?show=dir
RewriteRule ^$ http://example.com/ [nc]

My theory was that visiting files.example.com would redirect to example.com but visiting files.example.com/?show=dir or files.example.com/#dir would not; and obviously since ?show=dir does nothing it would list all my files as normal.

My RewriteConditions have no effect though.

Is this possible?

Solution

  • First, you can't match against URL fragments (the #dir part) because that doesn't ever get sent to the server. It's a client side only thing.

    Second, you can't match against the query string (the ?show=dir part) in the %{REQUEST_URI} variable, you need to use %{QUERY_STRING} instead.

    So try:

    RewriteEngine On
RewriteCond %{QUERY_STRING} !^show=dir$
RewriteRule ^$ http://example.com/ [nc]