Question

I have a directory called users which contains sub directories for each user. E.g. my directory structure might look like:

users/
    .htaccess
    UserAccess.php
    foo/
        baz.txt
    bar/
        passwd.txt

I want to prevent users from accessing other users files. Therefore, I wrote a php script which checks the path and prints the file contents or not. The problem is that the script is not being run, but rather apache is trying to access the files directly.

My .htaccess in the users/ directory is:

RewriteEngine on
RewriteRule ^users/ UserAccess.php

A user would then try to access http://mywebsite.com/users/username/file. E.g. http://mywebsite.com/users/foo/baz.txt.

The key point is that http://mywebsite.com/users/username/ is a REAL directory.

How do I fix this to accomplish what I want?

EDIT:

RewriteEngine on
RewriteRule . UserAccess.php

doesnt work either.

Answer 1

The answer was that the subfolder (foo in the example) had permissions 700. This caused a 403 response before the rewrite rule was parsed. I changed the permissions to 701 and everything worked.