Apache DirectoryMatch selects Directories and Files!

Discussion in 'Server Operation' started by emad, Jun 5, 2017.

  1. emad

    emad Member

    Hello,

    I have these directories and files for testing purpose:
    Code:
    /testingg.php
    /testingg/
    /testingg/test.php
    I'm using the following directives to restrict access to specific user directories, the file "/testingg.php" should be accessed and work normally but the directory "/testingg/" supposed to be protected and accessing not allowed.
    Code:
    <DirectoryMatch "^/var/www/clients/.*/.*/web/(testingg)/?">
      # Prevent the user from overriding these settings
      AllowOverride None
       
      Order deny,allow
      Deny from all
    </DirectoryMatch>
    

    Case 1:

    In this case accessing the dirs & files get the results
    Code:
    /testingg.php       [ERROR 403 - Forbidden!]  <---<<  Wrong
    /testingg/         [ERROR 403 - Forbidden!]
    /testingg         [ERROR 403 - Forbidden!]
    /testingg/test.php     [ERROR 403 - Forbidden!]
    
    The first result is unexpected, wrong and isn't reasonable at all because we use "DirectoryMatch" directive and this is a file!

    Case 2:
    If I add "$" to the end of the RegEx to be like this :
    Code:
    <DirectoryMatch "^/var/www/clients/.*/.*/web/(testingg)/?$">
    The results are:
    Code:
    /testingg.php       [Working]
    /testingg/         [Working]  <---<<  Wrong
    /testingg         [Working]  <---<<  Wrong
    /testingg/test.php     [Working]  <---<<  Wrong
    
    The 2nd, 3rd & 4th results are wrong of course. although the syntax seems to be right.

    Case 3:

    If I remove the "?" from the end of the (original code) RegEx to be like this :
    Code:
    <DirectoryMatch "^/var/www/clients/.*/.*/web/(testingg)/">
    The results are:
    Code:
    /testingg.php       [Working]
    /testingg/         [ERROR 403 - Forbidden!]
    /testingg         [ERROR 403 - Forbidden!]
    /testingg/test.php     [ERROR 403 - Forbidden!]
    
    All the results are right although the eliminated question mark supposed to mean if the slash exists or not, which is logically right.

    I can't understand what is happening.
    Why "DirectoryMatch" would select files too ?
    Why removeing the "?" solve the problem ?
    The DirectoryMatch directive RegEx in case 1 and 2 looks better than the one in case 3, but the the one in case 3 is the only one that works right.


    Test Environment:

    Server version: Apache/2.4.18 (Ubuntu-16.04)
     
  2. emad

    emad Member

    Any thoughts ?
     
  3. Stephan Ververda

    Stephan Ververda New Member

    Well, this is what apache has to say about the DirectoryMatch directive:
    So it seems that both case 1 and case 2 are not acceptable with the "/?" notation and case 3 is actually the correct way to write it (eventhough it's still weird it would give 403 on the rootfile)
     
    Last edited: Jun 8, 2017

Share This Page