Topic: Directory Privacy and mod_rewrite

[michon]

Apache 2.4 htaccess RewriteRule issue

Just recently updated our server to Apache 2.4 from 2.2 and have had some issues with password protected directories.
The accounts affected on the server are all staging accounts.
We create a staging account as subdomain of our staging domain (clientname.example.com) then password protect the root directory (public_html) via cPanel’s ‘Directory Privacy’ option.

All this worked fine when the server ran Apache 2.2, if you hit the sub domain then see the Apache login box and you’d be asked to enter the username and password. Wrong password, cancel or no credentials entered would result in a default server ‘Authorisation Required’ message.

But since updating to Apache 2.4 when you hit a sub domain the Apache login box still appears but if you cancel it or just click login without entering any credentials you still get taken to the ‘protected’ website and are able to see all text content but it’s unstyled all links, css js and images, result in a 404.

After talking to our server manager he say the issue is the WordPress htaccess RewriteRules. It overrides Apache showing the usual .shtml files.
We’ve found a work around by adding a new RewriteCond:

[James Blond]

RewriteCond %{REQUEST_URI} !^/(.*)\.shtml(.*)$