.htaccess blocking PHP file_get_contents

[Mooseman]

My .htaccess:
<Files .txt>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>

However, my PHP then can't get the contents of myfile.txt. How can I fix this? Thanks!

[Redcoder]

If you are using Windows and a server like Wamp or Xampp, there are also some bugs that are in combination of Windows, file_get_contents() and localhost that are not going to be fixed. Use cURL instead. file_get_contents has some php.ini values set off by default.

https://bugs.php.net/bug.php?id=38826
https://bugs.php.net/bug.php?id=40881

Use cURL. Off course you have to enable it if its not enabled but it most probably is.

PHP Code:

$file_path_str = "http://localhost/pathtofile";

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, ''.$file_path_str.'');
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt ($ch, CURLOPT_HEADER, 0);
curl_setopt ($ch, CURLOPT_USERAGENT, sprintf("Mozilla/%d.0",rand(4,5)));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_MAXREDIRS, 10);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$curl_response_res = curl_exec ($ch);
curl_close ($ch); 


Also remember, Apache in Windows by default can't access files outside www or htdocs folder.

[Mooseman]

Thank you, but Apache is running on Linux here, not Windows. When the .htaccess file in my first post is not present, I have no problem accessing the files with file_get_contents(). However, for security reasons, I can't have the txt files available through the web.

[Redcoder]

Well, then you need to rewrite the htaccess file and give it access to that folder.

RewriteCond %{REQUEST_URI} !/folderto.txtfile

But read up on editing it. You don't want to brick the set permissions.

[Rowsdower!]

Rather than monkeying around with the .htaccess, would it be possible to simply store the *.txt files above the webroot somewhere? It would be much simpler and if you REALLY don't want to allow access to the text files this is where they probably ought to be anyway.

That said, if you need to keep things the way they are then (depending on your application) you may need to use your host server's actual IP address rather than 127.0.0.1.

For example, I believe if you're using file_get_contents with a full URL to your text files (as opposed to using the local filepath) you are making an HTTP request and the IP address in use will be the proper public IP address of the server instead of 127.0.0.1.

If that doesn't apply to you, then I'm not sure why this isn't working already.

[Mooseman]

Just placed it above the web root. Worked with no problems at all! Thank you!