I ran into the following issue:
On a website I want to prevent "unauthorized" access to a set of .xml files - the user has to authenticate first. Now it would be possible for an authenticated user to type the URL of the file I don't want them to see. To prevent this, I created a simple php script that checks user authentication, then serves up the XML (with appropriate
At the same time, I put the following in the
.htaccess file in the directory with
.xml (and other) files:
<Files ~ "(.xml)"> Order allow,deny Deny from all Allow from xx.yy.zz.tt (IP address of server) </Files>
This did the trick -
.xml files were not longer "directly accessible", even for an "authenticated" user. But here is the thing I don't understand:
If I leave out the
'Allow from'line, the php script still manages to access the
.xmlfiles. It seems that the
.htaccessis completely ignored when it comes to php.
So my question is two fold:
- Is this expected behavior?
- If so, then what method would one use to prevent a php script from accessing a particular file (or group of files)?
There is clearly a fundamental issue around
.htaccess that I completely failed to grasp. Thanks for your insights.