Exclude a sub directory in a protected directory

Question

I need to exclude protection on one of the folder inside a protected directory with .htaccess

I put .htaccess in here:

/home/mysite/public_html/new/administrator/.htaccess

The directory need to be exclude from protection:

/home/mysite/public_html/new/administrator/components/com_phocagallery/

My .htaccess file :

AuthUserFile "/home/mysite/.htpasswds/public_html/new/administrator/passwd"
AuthType Basic
AuthName "admin"
require valid-user
SetEnvIf Request_URI "(/components/com_phocagallery/)$" allow
Order allow,deny
Allow from env=allow
Satisfy any

I tried but not working on my purpose. I suspect my path to the excluded directory may have some mistakes.

Answer 1

This is a very old question, but I see an error in the following line:

SetEnvIf Request_URI "(/components/com_phocagallery/)$" allow

The leading slash should not be there:

SetEnvIf Request_URI "(components/com_phocagallery/)$" allow

The way you have it is relative to the root of the OS instead of relative to the directory the .htaccess file is in.

Answer 2

As far as I know, this is not possible using plain old .htaccess directory protection. Maybe you can set up a web based authentication and check for each users rights before accessing directories.

The Apache HTTP server also has a lot of mod_auth*-modules, which may help you. See also: http://httpd.apache.org/docs/2.0/howto/auth.html

Answer 3

Rather than setting environment variables, perhaps you should consider creating a separate set of directives specific to the subdirectory - for example:

.htaccess file:

AuthUserFile "/home/mysite/.htpasswds/public_html/new/administrator/passwd"
AuthType Basic
AuthName "admin"
require valid-user
Satisfy all

public_subdirectory/.htaccess file:

# All access controls and authentication are disabled
# in this directory
Satisfy Any
Allow from all

Directives based upon Apache directives described in How to accomplish “AuthType None” in Apache 2.2 at StackOverflow.