Search code examples
apachesecurityapache2.4addhandler

Modify working AddHandler to match files only in the CURRENT directory, NOT child directories

The following works fine for allowing PHP to be executed on two XML files:

<FilesMatch ^(opensearch|sitemap)\.xml$>
AddHandler application/x-httpd-php5 .xml
</FilesMatch>

However unfortunately this rule would allow this to happen in any child directory as well.

  • /opensearch.xml, working/desired match
  • /henchman24/opensearch.xml, working/NOT desired match

How do we force Apache to only match the files in the current directory and not child directories?

I'd really like to:

  • Avoid adding a child .htaccess file in every possible child directory.
  • Avoid using an absolute server path.
Solution

  • If directive can be used to provide a condition for the handler to be added only for files matching the pattern in the current folder.

    The following example will add the handler for only files in the document root, such as /sitemap.xml and /opensearch.xml but not for /folder/sitemap.xml and /folder/opensearch.xml

    <FilesMatch ^(opensearch|sitemap)\.xml$>
<If "%{REQUEST_URI} =~ m#^\/(opensearch|sitemap)\.xml$#">
  AddHandler application/x-httpd-php .xml
</If>
</FilesMatch>

    In the above example, the condition is checking that the REQUEST_URI matches the regex pattern delimited in m# #. The ~= comparison operator checks that a string match a regular expression.

    The pattern ^\/(opensearch|sitemap)\.xml$ matches REQUEST_URI variable (the path component of the requested URI) such as /opensearch.xml or /sitemap.xml

    ^                      # startwith
\/                     # escaped forward-slash
(opensearch|sitemap)   # "opensearch" or "sitemap"
\.                     # .
xml                    # xml
$                      # endwith