阻止对目录的外部访问，但允许 SSI 访问（或者，“FilesMatch”指令实际上如何工作？）
在我使用 PHP 的旧网站上，我在目录 /noaccess 中有一个 .htaccess ，如下所示：
# /noaccess/.htaccess
<FilesMatch "^.*$">
order allow,deny
deny from all
</FilesMatch>
我有一个 PHP 文件，例如，
<html>
<body>
<?php include('noaccess/blah.ssi'); ?>
</body>
</html>
这工作正常，并且blah.ssi 的内容可见。
但是，在我当前的站点上，我正在使用 SSI，并且以下内容：
<html>
<body>
<!--#include virtual="noaccess/blah.ssi" -->
</body>
</html>
不起作用。日志显示无法包含“noaccess/blah.ssi”。删除 FilesMatch 指令即可工作。所以我显然误解了该命令的工作原理，我没有意识到它会阻止 Apache 本身。那么如何阻止来自 Web 的访问但允许 SSI 访问呢？ （我认为我可以（并且应该）存储我不想在 public_html 之外访问的内容，但这似乎在 SSI 包含中不起作用 - 但无论如何，即使它起作用，我有兴趣知道如何做到这一点）。
谢谢，T。
On an old site, where i was using PHP, I had a .htaccess in directory /noaccess as follows:
# /noaccess/.htaccess
<FilesMatch "^.*$">
order allow,deny
deny from all
</FilesMatch>
And I had a PHP file like,
<html>
<body>
<?php include('noaccess/blah.ssi'); ?>
</body>
</html>
This works fine and the contents of blah.ssi is visible.
However, on my current site I'm using SSI and the following:
<html>
<body>
<!--#include virtual="noaccess/blah.ssi" -->
</body>
</html>
does not work. The logs show unable to include "noaccess/blah.ssi". Remove the FilesMatch directive and it works. So I'm obviously misunderstanding how that command works, I didn't realise it would block Apache itself. So how can I block access from the web but allow SSI access? (I thought I could (and should) store the stuff I don't want accessed outside of public_html but that doesn't seem to work either in the SSI include - but anyway, even if it did, I'm interested to know how to do this).
Thanks, T.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
据我的经验所知，mod_include 遵循客户端的限制，因此您无法使用 apache 指令执行您想要的操作。
如果您想隐藏包含的文件，您可以使用
.htaccess文件上的Options -Indexes指令禁用目录索引。此外，您可以以难以猜测的方式命名包含的文件。我更喜欢的选择是使用 uuid，您可以使用 在线工具 生成它们或在工作站上安装一些实用程序：
As far as I know by experience, mod_include follows the limits of the client, so you cannot do what you want with apache directives.
If you want to hide the included files you can disable directory indexes with the
Options -Indexesdirective on your.htaccessfile, though. Also, you can name the included files in a hard to guess way.My prefered option would be using uuids, you can generate them with online tools or install some utility on your workstation:
如果您只想不允许人们在地址栏中输入文件时看到您的文件，那么您可以将它们放在没有索引（
-Indexes）和未发布名称的目录中，并且如果您永远不要泄露文件名（SSI 不会这样做），那么您只需要担心是否有人猜对了。您始终可以通过根据推荐人或类似内容禁止访问来阻止访问。if you only wanted to not allow people to see your files if they enter it in an address bar, then you could put them in a directory with no indexes (
-Indexes) and an unpublished name and if you never reveal the names of the files (which SSI does not do), then you only need worry if someone guesses one correctly. You can always block access by disallowing according to referrer, or something similar.