[SOLVED] X-Sendfile works for all folder and not just XSendFilePath

X-Sendfile works for all folder and not just XSendFilePath

I have xsendfile module working and files are being served using X-Sendfile header. But somehow files from any folder gets served. How do I rectrict it so that I can use X-sendfile headers only for specific folders? I have tried setting XSendFilePath, even then files outside that folder also get sent if I use X-Sendfile header.

This is what I have in my virtualhost section XSendFile on XSendFilePath /home/domain/public_html/files

If I use php to send files from /home/domain/public_html/abc using X-Sendfile. It gets sent without any problem. I do not want this. I only want X-Sendfile to work for files within /home/domain/public_html/files.

Solution

Try with the XSendFilePath directive

XSendFilePath allow you to add additional paths to some kind of white list. All files within these paths are allowed to get served through mod_xsendfile.