# Deny access per extension in multiple locations

**URL:** <https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160>\
**Category:** NGINX\
**Created:** [October 7, 2010, 6:08pm UTC](https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160 "2010-10-07T18:08:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [October 7, 2010, 6:08pm UTC](https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160/1 "2010-10-07T18:08:52Z")

</div>

Hello,

I have this rule in apache that denies access to some extensions in  
multiple locations.  
I have this .htaccess in some folders like uploads, docs, pdfs.

```
Order allow,deny
Deny from all

```

How can I join this in one line to deny access in multiple folders for  
these extensions?

I was trying this without success:

location ~ /(uploads/|docs/|pdfs/)\*.(php|cgi|pl|php3|php4|php5)$ {  
root /srv/www/portaldasviagens.com/public;  
deny all;  
}

Thanks

Posted at Nginx Forum:

> **[Deny access per extension in multiple locations](https://forum.nginx.org/read.php?2,138179,138179#msg-138179)**
>
> Hello, I have this rule in apache that denies access to some extensions in multiple locations. I have this .htaccess in some folders like uploads, docs, pdfs. \<Files ~ "^.\*\\.(php|cgi|pl|php3|php4|php5)"\> Order allow,deny Deny

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [October 7, 2010, 6:41pm UTC](https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160/2 "2010-10-07T18:41:05Z")

</div>

On 7 Out 2010 17h07 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> How can I join this in one line to deny access in multiple folders  
> for these extensions?
> 
> I was trying this without success:
> 
> location ~ /(uploads/|docs/|pdfs/)\*.(php|cgi|pl|php3|php4|php5)$ {  
> root /srv/www/portaldasviagens.com/public;  
> deny all;  
> }

Well I would approach the problem from a different angle:

1. First I would enumerate which locations require a upstream, be it  
another server or a FCGI process.

2. Then as my last location directive in the config file I would  
place:

location ~\* ^.+.(?:php[3-5]\*|cgi|pl) {  
return 404;  
}

This way there’s no loophole for having PHP or Perl files being  
executed outside of the specified locations.

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [October 7, 2010, 6:42pm UTC](https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160/3 "2010-10-07T18:42:50Z")

</div>

On 7 Out 2010 17h07 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> How can I join this in one line to deny access in multiple folders  
> for these extensions?
> 
> I was trying this without success:
> 
> location ~ /(uploads/|docs/|pdfs/)\*.(php|cgi|pl|php3|php4|php5)$ {  
> root /srv/www/portaldasviagens.com/public;  
> deny all;  
> }

Oops I forgot the $ in the regex ☹ Here it is.

location ~\* ^.+.(?:php[3-5]\*|cgi|pl)$ {  
return 404;  
}

— appa

---

<div class="post-metadata">

**Author:** ![nfn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/b19c9b/32.png) [@nfn](https://www.ruby-forum.com/u/nfn)\
**Post date:** [October 8, 2010, 12:06am UTC](https://www.ruby-forum.com/t/deny-access-per-extension-in-multiple-locations/196160/4 "2010-10-08T00:06:30Z")

</div>

On Thu, Oct 07, 2010 at 12:07:59PM -0400, nfn wrote:

Hi there,

> How can I join this in one line to deny access in multiple folders for  
> these extensions?
> 
> I was trying this without success:
> 
> location ~ /(uploads/|docs/|pdfs/)\*.(php|cgi|pl|php3|php4|php5)$ {  
> root /srv/www/portaldasviagens.com/public;  
> deny all;  
> }

Turn on “error\_log” with “debug”, then try to access one of the urls  
you want to have denied. Look for the log lines with “test location:”  
and “using configuration”. That will tell you which location block is  
being used for each request.

I suspect that the above regular expression does not match the locations  
you want it to match. Specifically, the “\*” probably wants a “.” before  
it.

Good luck,

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)