# Sample bin/.htaccess file.   If you require .htaccess files for your apache
# configuration, tailor this file using the below instructions.
# 
# Apache 2.4 users.  This file is built for Apache 2.2.  If you use Apache
# 2.4, you must enable mod_access_compat for backwards compatiblility
#
############### TAILORING INSTRUCTIONS #################
#
# This file controls access to Foswiki scripts - to make Apache use it, rename this
# file to 'bin/.htaccess' and REPLACE THE FOLLOWING STRINGS WHEREVER YOU SEE
# THEM IN THIS FILE WITH PATHS SPECIFIC TO YOUR INSTALLATION.
# Most required values have corresponding items in the  Path Settings section of
# configure.   The following 5 strings must be updated:
#
# {DataDir}
# {DefaultUrlHost}
# {ScriptUrlPath}
#
# Replace {DataDir} with the full path of the Topic files store (file path, not
# URL) e.g. /usr/local/foswiki/data   Do not include a trailing slash.  Do not
# include the { or } in the results.
#
# Example:   "Change all"  {DataDir} /var/www/foswiki/data
#   AuthUserFile {DataDir}/.htpasswd      becomes
#   AuthUserFile /var/www/foswiki/data/.htpasswd
#
# Replace {DefaultUrlHost} with the root of all Foswiki URLs e.g.
# http://myhost.com:123.  This is only used for htdigest authentication and
# can be ignored in most installations.  Do not include a trailing slash
#
# Replace {ScriptUrlPath} with the 'cgi-bin' part of URLs used
# to access the Foswiki bin  directory e.g. '/foswiki/cgi-bin'
#
# Note:  The combined {DefaultUrlHost}{ScriptUrlPath} will be used as the URL prefix:
# to access the foswiki scripts.  For example, to access the /view script:
#    http://myhost.com:123/foswiki/cgi-bin/view
#    {DefaultUrlHost     }{ScriptUrlPath }/view
#
#
# When this file has been completely tailored, complete your configuration at:
# {DefaultUrlHost}{ScriptUrlPath}/configure

##################################

# We set an environment variable called anonymous_spider
# Setting a BrowserMatchNoCase to ^$ is important. It prevents Foswiki from
# including its own topics as URLs and also prevents other Foswikis from
# doing the same. This is important to prevent the most obvious
# Denial of Service attacks.
# You can expand this by adding more BrowserMatchNoCase statements to
# block evil browser agents trying the impossible task of mirroring a Foswiki
# Example:
# BrowserMatchNoCase ^SiteSucker anonymous_spider
BrowserMatchNoCase ^$ anonymous_spider

######################################################################
# Now set default access rights.
# - This block will work with Apach 2.2, or 2.4 with mod_access_Compat enabled
# If this causes errors, comment this out, and enable the 2.4 specific block.
######################################################################
Order Allow,Deny
Allow from all
Deny from env=anonymous_spider

######################################################################
# Uncomment this block for Apache 2.4
######################################################################
#<RequireAll>
# Require not env anonymous_spider
# Require all granted
#</RequireAll>

# Use CGI & Perl to handle all files in 'bin' directory, i.e. run as scripts -
# this should remove the need to rename files to end in '.pl' etc, if your web
# hosting provider permits this.  Remove if using mod_perl.  Look at
# http://foswiki.org/Extensions/FastCGIEngineContrib to get info about FastCGI
# support.
SetHandler cgi-script

# Password file for Foswiki users
#

# Authentication type (htpasswd file) Uncomment this block if you are using Apache controlled login.
#AuthUserFile {DataDir}/.htpasswd
#AuthName 'Enter your WikiName. (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
#AuthType Basic

#for htdigest password suport uncomment the following
#AuthDigestDomain / {DefaultUrlHost}
#AuthDigestFile {DataDir}/.htdigest
#BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
#AuthDigestProvider file
#AuthUserFile {DataDir}/.htpasswd
# For "Digest" authentication to work properly, this string must match
# the value of configuration variable $authRealm
#AuthName 'Enter your WikiName. (First name and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to register if you do not have one.'
#AuthType Digest

#for LDAP password support uncomment the following (and fix up the paths)
#AuthLDAPURL ldap://yourldapserver/dc=yourldapserver,dc=com?uid?sub?(objectClass=posixAccount)
#AuthLDAPGroupAttribute memberUid
#AuthLDAPGroupAttributeIsDN off
#<Limit GET POST PUT>
#    require group cn=mygroup,ou=groups,dc=yourldapserver,dc=com
#</Limit>
#AuthName ByPassword
#AuthType Basic

# File to return on access control error (e.g. wrong password)
# By convention this is the UserRegistration page, that allows users
# to register with the Foswiki. Apache requires this to be a *local* path.
# Comment this out if you setup Foswiki to completely deny access to WikiGuest
# in all webs or change the path to a static html page.

# Alternatively if your users are all known to be registered you may want
# to redirect them to the ResetPassword page. Only uncomment one of these
# lines:

ErrorDocument 401 {ScriptUrlPath}/view/System/UserRegistration
# ErrorDocument 401 {ScriptUrlPath}/view/System/ResetPassword

# Set options for excuting CGI and allow symlinks for e.g. viewauth
# This also unsets any options allowing directory indexing etc.
Options ExecCGI FollowSymLinks

# These are scripts that might change content. The regular expression uses ".*"
# at the end so it matches the scripts even if you had to add a .cgi or .pl
# extension. If you want to require login for any other scripts, modify the
# regular expression below as appropriate.

# NB. The resetpasswd & passwd scripts are used to reset and change passwords.
# They do their own validation of the user and therefore
# should not use "require valid-user"

# When using Apache type login the following defines the Foswiki scripts
# that makes Apache ask the browser to authenticate. It is correct that
# scripts such as view, resetpasswd, rest, jsonrpc & passwd are not authenticated.
# (un-comment to activate)
#<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*">
#       require valid-user
#</FilesMatch>

# Make sure that any local lib definitions cannot be retrieved.
# (Use "Require all" statement if needed for Apache 2.4)

<Files  "LocalLib*">
#  Require all denied
  Order allow,deny
  Deny from all
</Files>

P
