Comments on: Security Enhancing with htaccess http://www.askapache.com/htaccess/securing-subdirectories-with-htaccess.html Advanced Web Development Thu, 16 May 2013 00:37:00 +0000 hourly 1 By: Al http://www.askapache.com/htaccess/securing-subdirectories-with-htaccess.html#comment-366 Al Thu, 30 Sep 2010 20:56:26 +0000 http://www.askapache.com.com/htaccess/securing-subdirectories-with-htaccess.html#comment-366 I'm not sure when you posted this, but excellent! I was looking the whole nigth till 06.00 in the morning and continued after a few hours sleep.

The first examples just did not work on my install for some reason, or because it is inside Drupal, where I like to have others view all of my modules/libraries/themes/plugins dirs and file contents of my test-installation, but not execute them. Both for security as well as that its meant for others to see source code.

First I did this:

Options +Indexes
IndexOptions +FancyIndexing</code>
Then inside the added modules etc dirs, there are files like xxx.module, xxx.info and xxx.tpl.php that didn't show-up at all. To correct them, this worked:
<pre>
Order Allow,Deny
Allow from All

Then I tried these examples and similar, but they all failed: http://www.askapache.com/htaccess/security-with-htaccess.html#deny-htaccess-htpasswd-access

Sam for your examples at the beginning; they just don't work inside my Drupal/server config; don't know why.
But when trying your ultimate example; everything works perfect and I get the php contents instead of executing!

Options -ExecCGI
RemoveHandler .cgi .pl .py .php4 .pcgi4 .php .php3 .phtml .pcgi .php5 .pcgi5
RemoveType .cgi .pl .py .php4 .pcgi4 .php .php3 .phtml .pcgi .php5 .pcgi5

I don't know why; think you haven't explained the last part of your conclusions and theory properly. But thanks a lot, because I couldn't find this elsewhere in many hours researching!

]]>