Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have the following mod_rewrite rule, which works fine in my Apache 2.x on CentOS 6 Linux machine, but is not complete:

    RewriteCond %{HTTP_COOKIE} !id
    RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
    RewriteRule .* /images/dummy.png [L]

because I'm trying to change it in 2 ways:

1) Actually 2 cookies (and not just 1 as above) should be present: id and auth (but I don't know, how to do (X or Y) and Z with mod_rewrite)

2) I'd like to verify that the value of the auth cookie is a 32 hex chars string (an MD5 hash) and that the value of id cookie is numeric.

The background is that I've gotten a bill for EUR 1000,- from Getty Images, because one of the Drupal users on my server has supposedly used their picture as avatar. I'm not looking for any lawyer or pseudo-lawyer advices here, just for the way to display a dummy image instead of real user pictures to web crawlers.

And yes, I've noticed in the mod_rewrite doc, that I could pass the cookie values to an external script through mod_rewrite (for verifying the MD5 hash), but I'd like to tackle this later.

UPDATE 2:

I've come up with the following

   RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
   RewriteCond %{HTTP_COOKIE} !auth=[a-fA-F0-9]{32} [OR]
   RewriteCond %{HTTP_COOKIE} !id=[0-9]+
   RewriteRule .* /images/dummy.png [L]

but I'm not sure, if the above RewriteCond's act as X and (Y or Z) or (X and Y) or Z

share|improve this question

migrated from serverfault.com Oct 18 '11 at 12:08

This question came from our site for professional system and network administrators.

add comment

1 Answer 1

up vote 1 down vote accepted

How about this:

RewriteEngine On
RewriteCond %{HTTP_COOKIE} !(^|;\s*)id=[0-9]+(;\s*)auth=[0-9a-fA-F]{32}(;\s*)
RewriteCond %{REQUEST_URI} ^/sites/default/files/pictures/picture-
RewriteRule .* /images/dummy.png [L]
share|improve this answer
    
Does this cover if "auth=" is in front of "id="? And is maybe \b better here, than (^|;) ? But I get your idea, thanks... –  Alexander Farber Oct 18 '11 at 11:36
    
If the "auth" arrives in the cookie first (i.e. before "id") your rule won't work. –  Olivier Pons Nov 14 '11 at 15:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.