We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 25847
    • 62 Posts
    Just thought of something... is there any possible way that the .htaccess file that I have in my root directory is overriding this one because of the rewrite engine being turned on?

    For example:

    At www.example.com, I have a .htaccess file which I am using in order to make MODx use the rewrite engine for pretty URL’s.
    At www.example.com/directoryiamtryingtoprotect I have my .htaccess file set up for Auth using a .htpasswd file.

    Does anyone think that these 2 files may be interacting with each other? If turning off the rewrite engine wouldn’t break my site right now, I would test this theory and see what happens.
      • 25663 MODX Staff
      • 12,272 Posts
      If you have a subdirectory in your install folder you’re trying to password protect via htaccess I don’t think it will work when FURLs are turned on. The reason I suspect this is because the first thing that will happen is that the root level rules will look to the virtual filesystem created by MODx and not find them in the database. You might be able to get around it by turning off the rewrite engine in the password protected directory though, like is done for the manager directory.

      Quick test: if it works with FURLs off, it’s an htaccess conflict and indeed will need an expert on that topic.
        Ryan Thrash, MODX Co-Founder
        Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
        • 25847
        • 62 Posts
        Ryan,

        You and I are indeed correct on this one. When FURLs are turned on, it does not work correctly. When I turn them off, everything works the way I need it to. Now all we need to do is find an apache wizard out there who knows how to get around this. After doing some further digging in a few apache books I have laying around, I am fairly certain that mod_rewrite is the cause of our troubles. Apparently mod_rewrite causes .htaccess apache auth problems when it is turned on. Looks like for now I will personally be using sub-domains for all of my protected content rather than folders in my root directory. If anyone else comes up with anymore ideas on this, please share them with us!

        UPDATE: I tried modifying the .htaccess file within the directory I want to protect to read as follows...
        RewriteEngine Off
        
        AuthType Basic
        AuthUserFile /home/user/example.com/protecteddirectory/.htpasswd
        AuthName "Members Area"
        require valid-user


        I was hoping that by doing this, I could turn off the RewriteEngine for this folder, but it does not work.
          • 25847
          • 62 Posts
          UPDATE: RESOLVED

          I finally figured it out!!!

          I had to add the following code to my .htaccess file in the root MODx directory. You have to make sure that you add this BEFORE the RewriteEngine On line in the existing MODx .htaccess file. Your .htaccess file should look like the following:

          # MODx supports Friendly URLs via this .htaccess file. You must serve web
          # pages via Apache with mod_rewrite to use this functionality, and you must
          # change the file name from ht.access to .htaccess.
          #
          # Make sure RewriteBase points to the directory where you installed MODx.
          # E.g., "/modx" if your installation is in a "modx" subdirectory. If you have
          # problems with your .htaccess working at all, try un-commenting the first 
          # line above the "RewriteEngine On" directive.
          #
          # You may choose to make your URLs non-case-sensitive by adding a NC directive
          # to your rule: RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC]
          
          #Options +FollowSymlinks
          
          <IfModule mod_rewrite.c>
          RewriteEngine On
          RewriteBase /
          #Example: RewriteCond %{REQUEST_URI} ^/(examplefolder|failed_auth\.html).*$ [NC]
          RewriteCond %{REQUEST_URI} ^/(DIRECTORY YOU NEED ACCESS TO|failed_auth\.html).*$ [NC]
          RewriteRule . - [L]
          </IfModule>
          
          RewriteEngine On
          RewriteBase /
          
          
          
          # Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
          #RewriteCond %{HTTP_HOST} .
          #RewriteCond %{HTTP_HOST} !^example-domain-please-change\.com [NC]
          #RewriteRule (.*) http://example-domain-please-change.com/$1 [R=301,L]
          #
          # or for the opposite domain.com -> www.domain.com use the following
          # >>> DO NOT USE BOTH THE ABOVE AND BELOW <<<
          #
          #RewriteCond %{HTTP_HOST} .
          #RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC]
          #RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L]
          
          
          
          # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent 
          # https://www.domain.com when your cert only allows https://secure.domain.com
          #RewriteCond %{SERVER_PORT} !^443
          #RewriteRule (.*) https://example-domain-please-change.com.com/$1 [R=301,L]
          
          
          
          # The Friendly URLs part
          RewriteCond %{REQUEST_FILENAME} !-f
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
          
          
          
          # Make sure .htc files are served with the proper MIME type, which is critical # for XP SP2. 
          
          Un-comment if your host allows htaccess MIME type overrides.
          
          #AddType text/x-component .htc
          
          
          
          # If your server is not already configured as such, the following directive
          # should be uncommented in order to set PHP's register_globals option to OFF.
          # This closes a major security hole that is abused by most XSS (cross-site
          # scripting) attacks. For more information: http://php.net/register_globals
          #
          # To verify that this option has been set to OFF, open the Manager and choose
          # Reports -> System Info and then click the phpinfo() link. Do a Find on Page
          # for "register_globals". The Local Value should be OFF. If the Master Value
          # is OFF then you do not need this directive here.
          #
          # IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :
          #
          # Your server does not allow PHP directives to be set via .htaccess. In that
          # case you must make this change in your php.ini file instead. If you are
          # using a commercial web host, contact the administrators for assistance in
          # doing this. Not all servers allow local php.ini files, and they should
          # include all PHP configurations (not just this one), or you will effectively
          # reset everything to PHP defaults. Consult www.php.net for more detailed
          # information about setting PHP directives.
          
          #php_flag register_globals Off
          
          
          
          # For servers that support output compression, you should pick up a bit of
          # speed but un-commenting the following lines.
          
          #php_flag zlib.output_compression On
          #php_value zlib.output_compression_level 5
          
          
          
          # The following directives stop screen flicker in IE on CSS rollovers. If
          # needed, un-comment the following rules. When they're in place, you may have
          # to do a force-refresh in order to see changes in your designs.
          
          #ExpiresActive On
          #ExpiresByType image/gif A2592000
          #ExpiresByType image/jpeg A2592000
          #ExpiresByType image/png A2592000
          #BrowserMatch "MSIE" brokenvary=1
          #BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1
          #BrowserMatch "Opera" !brokenvary
          #SetEnvIf brokenvary 1 force-no-vary


          The new code that I inserted as shown above was:

          <IfModule mod_rewrite.c>
          RewriteEngine On
          RewriteBase /
          #Example: RewriteCond %{REQUEST_URI} ^/(examplefolder|failed_auth\.html).*$ [NC]
          RewriteCond %{REQUEST_URI} ^/(DIRECTORY YOU NEED ACCESS TO|failed_auth\.html).*$ [NC]
          RewriteRule . - [L]
          </IfModule>
            • 25847
            • 62 Posts
            I just thought I’d post an update to this. Today I installed a fresh copy of MODx on a different hosting provider and this fix stopped working. However, it was super easy to fix the error and get this all working again. For LunarPages hosting I simply had to change my code to the following:

            <IfModule mod_rewrite.c>
            RewriteEngine On
            RewriteBase /
            #Example: RewriteCond %{REQUEST_URI} ^/(examplefolder|failed_auth\.shtml).*$ [NC]
            RewriteCond %{REQUEST_URI} ^/(projectinfo|401\.shtml).*$ [NC]
            RewriteRule . - [L]
            </IfModule>


            Note that I had to change the document/file extension from .html to .shtml to get this working on LunarPages. Apparently different hosts handle error documents differently according to differing .htconf files and/or Apache settings. Hopefully this helps someone out!
              • 36192 ☆ A M B ☆
              • 55 Posts
              The solution above didn't work for me, however adding the following line DID:

              ErrorDocument 401 default


              this should be placed just before this:

              RewriteEngine On
              RewriteBase /


              so all together it looks like this:

              ErrorDocument 401 default
              RewriteEngine On
              RewriteBase /


              The above info was gleaned from here: http://blog.servint.net/2014/01/31/rewrite-rule-conflicts-protecting-sub-directories-using-htaccess/