htaccess Elite

I ended up replacing it with the following configuration options, which achieve what I want:

Code: Select all

# These SetEnvIf statements get evaluated per request, before the
    # Rewrite* statements. The Header statement sets a cookie to
    # remember the visitor's original referrer until the visitor submits the
    # contact form.
    SetEnvIf Request_Method ".*" set_referrer_url_from_http_referer
    SetEnvIf Referer "^$" !set_referrer_url_from_http_referer
    SetEnvIf Referer "^http://(www\.)?mydomain\.com"
!set_referrer_url_from_http_referer
    SetEnvIf Request_URI "^/vanity_url/" !set_referrer_url_from_http_referer
    Header add Set-Cookie "original_referrer_url=%{HTTP_REFERER}e;
domain=.mydomain.com" env=set_referrer_url_from

    # The Rewrite* statements are needed to handle the case when
    # vanity URLs are used. Vanity URLs are of the form
    # www.mydomain.com/abc. A vanity URL of the form /(abc) gets remapped
    # to /vanity_url/abc.html, etc.... The original referrer information is
    # also retained, which is important because if we simply did it in the
    # SetEnvIf and Header section above, the referrer would be lost because
    # the rewrite causes an internal redirect, which causes the referrer
    # HTTP header to be lost.
    RewriteEngine on
    RewriteBase /
    RewriteCond "/home/mydomain/www/public_html/vanity_url/$1.html" -s
    RewriteCond "%{HTTP_REFERER}" "^http://(.+)$"
    RewriteRule "^([a-zA-Z0-9]+)$" "vanity_url/$1.html"
[CO=original_referrer_url:%1:.mydomain.com,L]

    RewriteCond "/home/mydomain/www/public_html/vanity_url/$1.html" -s
    RewriteRule "^([a-zA-Z0-9]+)$" "vanity_url/$1.html" [L]

When I said the original configuration setting did not work, I meant that it did
not set the cookie as I wanted. Regardless, now I have my problem resolved in a
good way. however, I think cookie flag of the RewriteRule directive does not
allow environment variables. If it were consistent, you would think that the
cookie flag should allow environment variables.

First thing to check on a 500-Server Error is your error log. It will tell you what the problem is. If you don't have access to your error log, it's time to look for a new host; You can't do much serious server-side stuff without an error log.

I'm not sure if this is a cut-n-paste error or the effects of posting on this board, but you must have space in the RewriteConds between the characters "}" and "!", and the last line is missing the closing "]".

I tested the code I posted in msg#18, and it works correctly on my servers. The URL is rewritten, the query string is populated, and the environment variable is populated and passed to the script correctly.

Code: Select all

DirectoryIndex cgi-bin/y/d.cgi/?index-IPP10000 index.htm
Options +FollowSymlinks -Indexes -MultiViews
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain\.com [NC]
RewriteRule \.(gif¦jpe?g¦png¦bmp)$ - [F,NC]
RewriteRule ^\.htaccess$ - [F]
#
# New Test of URL passing variables
#
RewriteRule ^([0-9]+)/([a-z]+)/?$ /cgi-bin/y/d.cgi?$2-IPP$1 [NC,E=MY_VAR:$1,C]
RewriteRule .* - [L]
#
RewriteRule ^([0-9]+)/?$ /cgi-bin/y/d.cgi?index-IPP$1 [E=MY_VAR:$1,C]
RewriteRule .* - [L]

Some of the changes (bolded) above are just clean-ups for efficiency, such as removing the redundant [L] from a rule with [F]. Others will prevent problems, such as the second RewriteCond failing for your hostname if a port number is appended.

Jim

The md5 hash of the filename would have to be a fixed value; mod_rewrite can match (test) pre-defined URL strings and pass requests to scripts, but cannot directly call functions, such as MD5 hash routines.

This solution sounds over-complicated, and -- begging your pardon -- ineffective. Regardless of any modification or encoding of the filename, it will be "visible" to the user's browser and therefore, directly accessible -- at least for the next hour.

I'd suggest you look into issuing a short-lived cookie to each user who visits an authorized page on your site, and then check for that cookie using mod_rewrite (or a server-side script) before serving the .swf file. Users with a correct and current cookie can be redirected to the .swf file, and those with an expired cookie or no cookie can be redirected to a "please login" file -- both would have to be be .swf files. Only the browser would have the cookie, so any attempt to request the .swf file with a download tool would fail. Hotlinking would not work, because the linking site would not be able to issue the required cookie with the correct realm.

Another alternative would be to redirect all requests for the .swf file to a server-side script to handle the authorization, if you are more comfortable with perl or php, for example.

You can test to see if the "valid page" exists, and if not, rewrite to the "special page":

Code: Select all

# Get cookie value if it exists
RewriteCond %{HTTP_COOKIE} curso=([^;]+)
# if valid page exists as a file
RewriteCond %{DOCUMENT_ROOT}/mir/lecciones/%1/$2 -f
# internally rewrite to valid page
rewriterule ^/conflict_directory/([^/])+/(.+\.html?)$ /mir8/lecciones/%1/$2 [L]
# else rewrite to special page
rewriterule ^/conflict_directory/([^/])+/(.+\.html?)$ /special_page.html [L]