2

How to avoid apache allow download certain files? (for example .py and .sh)

I want to avoid files to be served and downloaded like

www.site.com/file.sh
www.site.com/file.py

but I've tried to do this

<Files ~ "^\.sh">
   Order deny,allow
   deny from all
</Files>

<Files ~ "^\.py">
   Order deny,allow
   deny from all
</Files>

also this

<FilesMatch "\.(sh|py)$">
   Order deny,allow
   deny from all
</FilesMatch>

Nothings seems to work, I've tried to put the file in

/etc/apache2/apache2.conf

also

/etc/apache2/sites-available/default

Nothing works, apache still let me download the files.

  • Of course, this just means someone will simply rename the files with a .txt extension. – Andrew Henle Aug 15 '18 at 15:27
5
+50

Your file match clauses seem to be incorrect.

<Files ~ "^\.py">

will match files whose names will start with characters .py. You'll want

<Files ~ "\.py$">

instead.

But your FilesMatch regular expression looks correct. So maybe the problem lies elsewhere. Perhaps your Apache uses the new-style access control directives only?

Try replacing the old-style

Order deny,allow
deny from all

with the new-style equivalent:

Require all denied
  • Done!, the <Files> fix, fixed the issue, in /etc/apache2/apache2.conf – Hernán Eche Aug 15 '18 at 20:13
  • FilesMatch doesn't seem to work in this apache v 2.2 – Hernán Eche Aug 15 '18 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.