htaccess redirect question inside...

htaccess redirect question inside...

Post by Lophopho » Sat, 26 Oct 2002 09:28:53



Sorry if this is the wrong group for this post, I've been trying to
find an answer for a couple hours know.

I know how to use htaccess in setting up password protected
directories as well as add users etc.  As of now the users visiting my
site are required to enter username and password twice to reach their
destination.  Once to get into file area and second to log into their
personal account.

Know I'm wondering if it's possible to redirect a user based on
username and password.  This is what I attempted to do...It didn't
work...

AuthUserFile /usr/home/ckt/upload.users
AuthGroupFile /usr/home/ckt/upload.groups
AuthName "File Upload/Download Security Check"
AuthType Basic

<Limit GET POST>
require group files
</Limit>

Rewri*gine On
RewriteCond %{LA-U:REMOTE_USER} ^test1* [NC]
RewriteCond %{LA-U:REMOTE_USER} ^group1* [NC]
RewriteRule ^/$  /group1/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^lsi* [NC]
RewriteRule ^/$  /Lsi/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^bae* [NC]
RewriteRule ^/$  /BAE/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^boeing* [NC]
RewriteRule ^/$  /Boeing/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^wrc* [NC]
RewriteRule ^/$  /WRC/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^glw* [NC]
RewriteRule ^/$  /Glw/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^jmathey* [NC]
RewriteRule ^/$  /J_Mathey/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^northrop* [NC]
RewriteRule ^/$  /Northrop/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^photo_circuits* [NC]
RewriteRule ^/$  /Photo_Circuits/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^samsung* [NC]
RewriteRule ^/$  /Samsung/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^adtec* [NC]
RewriteRule ^/$  /Adtec/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^lfwc* [NC]
RewriteRule ^/$  /Lockheed/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^ibm* [NC]
RewriteRule ^/$  /Ibm/index.shtml [L]

I would love it if someone could give some difinitive answers.  I
think that my only alternative would be some perl scripts, but I don't
know perl.

Thanks,

Phil

 
 
 

htaccess redirect question inside...

Post by cyberdoc » Sun, 27 Oct 2002 11:52:04


Got it to work!  Wow, that really sucked the life-force out of me!

Why must you use the "QUERY_STRING" to make this work?

Here's what it looks like:

AuthType Basic
AuthUserFile /usr/home/ckt/upload.users
AuthGroupFile /usr/home/ckt/upload.groups
AuthName "File Upload/Download Security Check"

Require group files

Rewri*gine On
RewriteCond %{LA-U:REMOTE_USER} user
RewriteCond %{QUERY_STRING} ^$
RewriteRule ^$  http://domain/misc/private/ [R,L]

RewriteCond %{LA-U:REMOTE_USER} user1
RewriteCond %{QUERY_STRING} ^$
RewriteRule ^$  http://domain/misc/private1/ [R,L]

etc, etc.

This solves the problem in previous post.  Didn't know what htaccess
was until yesterday.

 
 
 

htaccess redirect question inside...

Post by mr_sca » Mon, 28 Oct 2002 16:11:23



said the following:

Quote:>Got it to work!  Wow, that really sucked the life-force out of me!

>Why must you use the "QUERY_STRING" to make this work?

>Here's what it looks like:

>AuthType Basic
>AuthUserFile /usr/home/ckt/upload.users
>AuthGroupFile /usr/home/ckt/upload.groups
>AuthName "File Upload/Download Security Check"

>Require group files

>Rewri*gine On
>RewriteCond %{LA-U:REMOTE_USER} user
>RewriteCond %{QUERY_STRING} ^$
>RewriteRule ^$  http://domain/misc/private/ [R,L]

>RewriteCond %{LA-U:REMOTE_USER} user1
>RewriteCond %{QUERY_STRING} ^$
>RewriteRule ^$  http://domain/misc/private1/ [R,L]

>etc, etc.

>This solves the problem in previous post.  Didn't know what htaccess
>was until yesterday.

Figured what out?  What was the original problem?
 
 
 

htaccess redirect question inside...

Post by Lophopho » Thu, 31 Oct 2002 07:29:39




> said the following:

> >Got it to work!  Wow, that really sucked the life-force out of me!

> >Why must you use the "QUERY_STRING" to make this work?

> >Here's what it looks like:

> >AuthType Basic
> >AuthUserFile /usr/home/ckt/upload.users
> >AuthGroupFile /usr/home/ckt/upload.groups
> >AuthName "File Upload/Download Security Check"

> >Require group files

> >Rewri*gine On
> >RewriteCond %{LA-U:REMOTE_USER} user
> >RewriteCond %{QUERY_STRING} ^$
> >RewriteRule ^$  http://domain/misc/private/ [R,L]

> >RewriteCond %{LA-U:REMOTE_USER} user1
> >RewriteCond %{QUERY_STRING} ^$
> >RewriteRule ^$  http://domain/misc/private1/ [R,L]

> >etc, etc.

> >This solves the problem in previous post.  Didn't know what htaccess
> >was until yesterday.

> Figured what out?  What was the original problem?

Here's the original probem:

"I know how to use htaccess in setting up password protected
directories as well as add users etc.  As of now the users visiting my
site are required to enter username and password twice to reach their
destination.  Once to get into file area and second to log into their
personal account.

Know I'm wondering if it's possible to redirect a user based on
username and password.  This is what I attempted to do...It didn't
work...

AuthUserFile /usr/home/ckt/upload.users
AuthGroupFile /usr/home/ckt/upload.groups
AuthName "File Upload/Download Security Check"
AuthType Basic

<Limit GET POST>
require group files
</Limit>

Rewri*gine On
RewriteCond %{LA-U:REMOTE_USER} ^test1* [NC]
RewriteCond %{LA-U:REMOTE_USER} ^group1* [NC]
RewriteRule ^/$  /group1/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^lsi* [NC]
RewriteRule ^/$  /Lsi/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^bae* [NC]
RewriteRule ^/$  /BAE/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^boeing* [NC]
RewriteRule ^/$  /Boeing/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^wrc* [NC]
RewriteRule ^/$  /WRC/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^glw* [NC]
RewriteRule ^/$  /Glw/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^jmathey* [NC]
RewriteRule ^/$  /J_Mathey/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^northrop* [NC]
RewriteRule ^/$  /Northrop/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^photo_circuits* [NC]
RewriteRule ^/$  /Photo_Circuits/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^samsung* [NC]
RewriteRule ^/$  /Samsung/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^adtec* [NC]
RewriteRule ^/$  /Adtec/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^lfwc* [NC]
RewriteRule ^/$  /Lockheed/index.shtml [L]

RewriteCond %{LA-U:REMOTE_USER} ^ibm* [NC]
RewriteRule ^/$  /Ibm/index.shtml [L]

I would love it if someone could give some difinitive answers.  I
think that my only alternative would be some perl scripts, but I don't
know perl.

Thanks,

Phil"

 
 
 

htaccess redirect question inside...

Post by Randal L. Schwar » Sat, 02 Nov 2002 23:45:10


Lophophora> <Limit GET POST>
Lophophora> require group files
Lophophora> </Limit>

Please do not Limit the Limits.

Remove the lines with <Limit...> and </Limit>

Otherwise, you are likely opening yourself up to a security hole.

THIS MEME REFUSES TO DIE... {sigh}

--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095

Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

 
 
 

htaccess redirect question inside...

Post by 2Host.com - Rober » Sun, 03 Nov 2002 00:13:27


...

Quote:> <Limit GET POST>
> require group files
> </Limit>

...

If you limit yourself to GET and POST, you limit yourself to GET and
POST. There are more methods than GET and POST.
--
Regards,

Server admin, support & programing for shared & dedicated web servers
Secure, reliable hosting you expect and deserve! http://www.2host.com

 
 
 

1. Apache executing cgi-scripts inside .htaccess protected directories

Hi,

Is it possible to execute cgi scripts in .htaccess protected directories,
and to have these scripts call other scripts in the same directory?

I'm using CGI scripts to generate forms. The scripts are located in
directories protected by a .htaccess mechanism. The action for the first
form (lets call it foo.cgi) is a second cgi script (let's call it test.cgi).

Let's say that foo.cgi (written in tcl) has something like.

#!/usr1/bin/tclsh
puts "Content-type: text/html\n"
puts "<Head>"
puts "</head>"
puts "<BODY >"
puts "<FORM ENCTYPE=\"multipart/form-data\" NAME = form_er METHOD=POST
ACTION=\"test.cgi\">"
puts "<H3>File Information</H3>"
puts ""
puts "CAD System  :<SELECT NAME=\"cadsrc\"> "
puts "            <OPTION> Pro/Engineer"
puts "            </SELECT> <P>"
puts "<input type = submit value = \" Send \">     <INPUT TYPE=reset
VALUE=\" Clear Entries \">"
puts "</FORM>"

Assuming that all test.cgi does is print out the environment variables.

#!/usr1/bin/tclsh
puts "Content-type: text/html\n"
puts "<HTML>"
puts "<HEAD>"
puts "<TITLE>User  has been registered</TITLE>"
puts "</HEAD>"
puts "<BODY >"
foreach name [array names env] {
      puts "$name is  $env($name) <br>"
puts "</BODY>"
puts "</HTML>"

The problem I'm having is that having authenticated properly to foo.cgi,
the authentication is not recognized when I "submit" the action (and
try to execute test.cgi). If I place test.cgi in an unprotected directory,
I have no problem completing the action from foo.cgi. BUT, I no longer
have the REMOTE_USER environment variable properly set (which I
need for my application). I have no problem executing test.cgi directly
(i.e., opening http://my.www.server/test.cgi)....I simply authenticate
and the REMOTE_USER variable is set and echoed back to me.
All of this is with Apache 1.0.2.

Any help with this matter would be appreciated.
thanks.
-bill

2. What is RANLIB?

3. Use of IF constructs inside .htaccess files??

4. MotherBoard MSI KT3

5. HELP! htaccess INSIDE the SSL layer????

6. Need a good article, paper, user warning on password selection

7. Q: ipmasqadm (access from inside to external redirected services)

8. View postscript and Adobe acrobat PDF in CDE?

9. iptables: redirecting packets inside a firewall

10. redirect port 80 traffic to machine inside firewall?

11. Q: How to redirect stdin inside a csh script ?

12. .htaccess and user redirect

13. Redirect - .htaccess