5

How to avoid apache allow download certain files? (for example .py and .sh)

I want to avoid files to be served and downloaded like

www.site.com/file.sh
www.site.com/file.py

but I've tried to do this

<Files ~ "^\.sh">
   Order deny,allow
   deny from all
</Files>

<Files ~ "^\.py">
   Order deny,allow
   deny from all
</Files>

also this

<FilesMatch "\.(sh|py)$">
   Order deny,allow
   deny from all
</FilesMatch>

Nothings seems to work, I've tried to put the file in

/etc/apache2/apache2.conf

also

/etc/apache2/sites-available/default

Nothing works, apache still let me download the files.

1
  • Of course, this just means someone will simply rename the files with a .txt extension. Commented Aug 15, 2018 at 15:27

1 Answer 1

8
+50

Your file match clauses seem to be incorrect.

<Files ~ "^\.py">

will match files whose names will start with characters .py. You'll want

<Files ~ "\.py$">

instead.

But your FilesMatch regular expression looks correct. So maybe the problem lies elsewhere. Perhaps your Apache uses the new-style access control directives only?

Try replacing the old-style

Order deny,allow
deny from all

with the new-style equivalent:

Require all denied
2
  • Done!, the <Files> fix, fixed the issue, in /etc/apache2/apache2.conf Commented Aug 15, 2018 at 20:13
  • FilesMatch doesn't seem to work in this apache v 2.2 Commented Aug 15, 2018 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .