.htaccess rewrite question

24,544 Posts

BobRay Reply #1, 14 years, 11 months ago

OK, this is driving me nuts. Say I want to block access for any request with the word 'reflect' in the URL.

It seems to me that this code should do it:

RewriteEngine On                                   
RewriteBase /

RewriteCond %{REQUEST_URI} reflect [NC,OR]
RewriteCond %{QUERY_STRING} reflect [NC]        
RewriteRule .* - [F,L]        

# The Friendly URLs part
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

If I remove the Friendly URLs part, it works perfectly. My understanding is that using '[F,L]' will stop processing when that rule is matched, so the FURL part shouldn't execute.

Apparently I don't understand how .htaccess is processed and I've found no illumination on the web.

The site is in a subdomain, but I don't see how that's a factor, and if I change the rewrite base, I get a 500 error.

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

928 Posts

kp52 Reply #2, 14 years, 11 months ago

Not sure how REQUEST_URI works, but this is what I have in .htaccess to fob off people looking for the reflect vulnerability (if you'll pardon my French):

Options +FollowSymlinks
RewriteEngine On
RewriteBase /

# Tell hackers to sod off
RewriteCond %{QUERY_STRING} snippet\.reflect\.php [NC,OR]
RewriteCond %{QUERY_STRING} reflect_base [NC,OR]
RewriteCond %{QUERY_STRING} phpbb [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl [NC]
RewriteCond %{HTTP_USER_AGENT} ^perl [NC]
RewriteRule .* - [F,L]

;) KP

24,544 Posts

BobRay Reply #3, 14 years, 11 months ago

That's essentially the same as what I have, though mine is more general, but it doesn't work for me if it's followed by the MODX FURL code (which continues to make no sense to me).

I can't use FollowSymlinks for some reason -- it throws a 500 error.

I made a plugin to log file-not-found requests and the miscreants are looking for a wide variety of reflect-related files, not just the reflect snippet file. Of course some of them are also looking for WordPress, Drupal, and Joomla files as well as PhPMyAdmin. I plan to add checks for them if I can ever get this working.

FYI, the file-not-found log is quite interesting reading and I found a number of links to files on my site that had changed aliases or were links to actual pages but with the case wrong.

The plugin is in a package called BotBlockX that I'm working on. It should be available very soon. It also has a reflect-block in it, which would be unnecessary if I could get .htaccess to work.

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting