.htaccess for admin panel

[eluser]noslen1[/eluser]
Hi everyone,

I have 2 applications for my frontend/backend but I can't find the right .htaccess in order to remove the index.php and admin.php, and have this behavior :

Frontend :
www.domain.com/controller/function/

Backend :
www.domain.com/admin/controller/function

I've searched a long time for a bit of code resolving my problem, but I haven't ever seen someone with my folder structure :

Code:

/admin/
/site/
/system/
/index.php (pointing to /site)
/admin.php (pointing to /admin)
/.htaccess

I easily managed to remove index.php from my URLs, but the admin.php...

Can someone please help me? Thanks ;-)

[eluser]PhilTem[/eluser]
Should be something like this

Code:

Options +FollowSymLinks
Options +Indexes
RewriteEngine On
RewriteBase /

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

RewriteCond $1 !^(admin\.php)
RewriteRule ^admin(.*)$ /admin.php/$1 [L]

RewriteCond $2 !^(index\.php)
RewriteRule ^(.*)$ /index.php/$2 [L]

taken from the default .htaccess. But don't trust me too much since I'm not that proficient with RewriteConds and RewriteRules (but with RegExs I'm going well, just not sure how the RewriteRule "needs it")

Anyway this should serve as a good starting point for others

PS: Have you thought of just putting all your admin-related controllers into an "admin"-subfolder in your controllers directory and securing it via session? Would make your life soooo much easier

[eluser]noslen1[/eluser]
Any other solution ?

I guess i have to set in my admin/config/config.php :

Code:

$config['index_page'] = 'admin';

I tried playing with PhilTem answer, but could not reach a good result, still having "404 Page Not Found"

Here is my .htaccess

Code:

Options +FollowSymlinks -MultiViews -Indexes

<IfModule mod_rewrite.c>

RewriteEngine on
RewriteBase /muki

# If the user types "index.php" or "admin.php".
RewriteCond $1 !^(index\.php|admin\.php|images|robots\.txt)

# If the user types just "admin".
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^admin$ admin\.php [L,QSA]

# If the user enter in any admin section, like "admin/section".
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^admin\/(.*)$ admin\.php/$1 [L,QSA]

# If the user types any site section, like "site/section".
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index\.php/$1 [L,QSA]
</IfModule>

<IfModule !mod_rewrite.c>
    ErrorDocument 404 /index.php
</IfModule>

PS : I'd like to keep my folder structure as it is now, but if it is impossible to redirect correctly, then surely...

Thanks for your help

[eluser]NiconPhantom[/eluser]
Hi

for admin/config/config.php

1. $config['index_page'] = '';
You don't have to use admin here. Just use URI routing instead as described here http://ellislab.com/codeigniter/user-gui...uting.html

2. $config['uri_protocol'] = 'REQUEST_URI';

3. I have following .htaccess in my application:

RewriteEngine on
RewriteCond $1 !^(index\.php|resources|robots\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L,QSA]

[eluser]Aken[/eluser]
If you're using one of the newer versions of CI, there is an .htaccess file inside the application directory that denies any direct requests for it. Assuming you've copied the application folder and renamed it "admin", that .htaccess folder is still there. When you access a URL that begins with "admin", it will find the physical directory, see that there is another .htaccess file inside of it, and automatically give it priority, effectively denying all requests. There is also the problem with the directory check in the home .htaccess - since it's a valid physical directory, the admin rewrite won't be initiated.

1. Don't name your admin application folder "admin". Name it something else. Update your admin.php "index" file appropriately.

2. RewriteCond lines are only valid for a single RewriteRule call. Once you call a RewriteRule, you need to duplicate any of the same RewriteCond, or they will not be available.

3. In your admin's config.php file, you do not HAVE to use the index_page setting. However, if you add "admin" to it, CI's convenient URL helpers will automatically prepend that segment, making creating links a little easier. Then you can do things like this:

Code:

echo site_url('viewposts'); // Generates: http://mysite.com/admin/viewposts

4. Here is a more suitable .htaccess for you to at least start with. Add to it where necessary:

Code:

Options +FollowSymlinks -MultiViews -Indexes

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteBase /muki

# Admin URLs
# RewriteCond's are not necessary here if there will be no
# static assets (images/css/js) whose URLs start with "admin"
RewriteRule ^admin(/.*)?$ admin.php/$1 [L,QSA]

# Public website
# The first two rules say "If this path is not an existing file or directory"
# The third conditional is good for preventing rewrites for directories
# commonly accessed for static assets. It will prevent unnecessary calls to
# your application if there are any 404 errors in those directories.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1 !^(images|css|js)
RewriteRule ^(.*)$ index.php/$1 [L,QSA]
</IfModule>

<IfModule !mod_rewrite.c>
    ErrorDocument 404 index.php
</IfModule>

[eluser]noslen1[/eluser]
Thanks for your answers guys.

I'm using one of the latest CI (don't know which one but it's a 2.x version), and I noticed the .htaccess inside applications folder denying request. I just deleted them... Is this wrong ? Or should just change "deny" to "allow" ? But the .htaccess won't have any sense there after I guess !

[quote author="Aken" date="1350373596"]
1. Don't name your admin application folder "admin". Name it something else. Update your admin.php "index" file appropriately.
[/quote]
Why that ? In terms of security because everybody knows the /admin trick ?

I tried your sample of .htaccess :
Frontend works, but backend sends me back to the front without the /admin prefix.

PS : I hate .htaccess files...


I played with config/routes file as mentionned by NiconPhantom.
Well It did pretty good, if I set in my config/config.php

Code:

$config['index_page'] = 'admin';

And in my config/routes.php

Code:

$route['admin/(:any)'] = "/$1";

All is working great, backend almost no problem for URLs like /admin/controller/function/params/ except for the login controller by default, that is not accessible when I just type /admin. It says "403 : Directory access is forbidden." from the index.html.
How can I fix that ?

[eluser]Aken[/eluser]
Leave the .htaccess in your application and system directories as they are - they're there for a reason.

And read my response and try what I recommended - you're not doing any of it and asking me why there are still problems.

[eluser]NiconPhantom[/eluser]
Hi Noslen1,

Could you please add following line to routes.php:

$route['admin'] = "admin"; or $route['admin'] = "admin/admin"; according to hierarchy

$route['admin'] is basically URI and "admin" = desired controller

Hope that helps,

Alex

[eluser]Aken[/eluser]
[quote author="NiconPhantom" date="1350377931"]Hi Noslen1,

Could you please add following line to routes.php:

$route['admin'] = "admin"; or $route['admin'] = "admin/admin"; according to hierarchy

$route['admin'] is basically URI and "admin" = desired controller

Hope that helps,

Alex[/quote]

You're not helping. He's trying to route all admin requests to an entirely different application, including folder and main .php file - routes are not applicable to this.

[eluser]noslen1[/eluser]
Ok Aken, so :

- I kept .htaccess in my applications folder.
- I renamed my '/admin' application folder as '/blob', renamed my 'admin.php' as 'blob.php' as well, modified it to $application_folder = 'blob';
- Deleted my added routes
- I change the config as $config['index_page'] = ''
- I took your .htaccess sample, and changed where you type 'admin' and replaced with 'blob' :

Code:

RewriteRule ^blob(/.*)?$ blob.php/$1 [L,QSA]

I think i've followed your recommandations now, but it does not solve my issue.
Typing URL as localhost/muki/blob throws me a "403 Forbidden You don't have permission to access /muki/blob/ on this server."