如何限制对nginxdynamic生成的位置的访问？

我的开发人员只允许将一些文件下载到局域网用户。 我说好吧，这很简单，我写了像这样的nginxconfiguration的变化：

location /restricteddir/download/file { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; } 

好，从外面我得到403这样好，但从内部（LAN）给我404。为什么？

我已经检查过，磁盘上不存在文件的位置。 开发人员告诉我，这个位置是由phpdynamic生成的，所以文件在tmp目录中，但是当你点击如下链接之后：

https://example.com/report/download/file/id/somefile.txt它应该开始下载，但它给404错误。

• IIS 6拒绝访问默认文档
• BIND9服务器types
• 移动用户的笔记本电脑自动协商现在必须？
• Nginx重写规则“^ /（ {32}）\。png $”不起作用（用于Apache）
• 无法重新启动php5-fpm

最后一个物理位置是/restricteddir/download所以file/id/somefile.txt是由php生成的。

为了testing，我将位置更改为/restricteddir/download ，之后https://example.com/restricteddir/download给了我404。

禁用限制后，我很困惑，所有目录工作正常，我可以从https://example.com/report/download/file/id/somefile.txt下载文件，然后按https://example.com/report/download/无404.那么错误在哪里？ 我应该添加到我的nginxconfiguration，使其工作？

EDIT1这是这个虚拟主机的完整configuration：

 #example.com:443 server { listen 443 default; ssl on; ssl_certificate example.crt; ssl_certificate_key example.key; ssl_session_timeout 15m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl_prefer_server_ciphers on; server_name example.com; access_log /var/log/nginx/example.com.access.log; error_log /var/log/nginx/example.com.error.log; location / { root /sites/public; index index.php; if (!-f $request_filename) { rewrite ^.*$ /index.php last; break; } } location /restricteddir/download/file { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; } #PHP location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include /fastcgi_params; fastcgi_param SCRIPT_FILENAME /sites/public$fastcgi_script_name; } } server { listen 80 default; server_name example.com; access_log off; rewrite ^(.*)$ https://example.com$1 permanent; } 

我在我的日志中创build了这个：

 2012/08/07 11:55:43 [error] 11121#0: *90 open() "/usr/share/nginx/html/restricteddir/download/file/id/somefile.txt" failed (2: No such file or directory), client: 10.200.2.70, server: example.com, request: "GET /restricteddir/download/file/id/somefile.txt HTTP/1.1", host: "example.com" 

所以现在我知道nginx在/usr/share/nginx/html/ /sites/public

所以也许我应该这样写：

 location /sites/public/restricteddir/download/file { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; } 

EDIT2

我把根指令移动到服务器块，现在在启用限制位置/ restricteddir /下载/文件中的日志我有：

 2012/08/09 10:43:12 [error] 32120#0: *71 open() "/site/public/restricteddir/download/file/id/somefile.txt" failed (2: No such file or directory), client: 10.2.1.120, server: example.com, request: "GET /restricteddir/download/file/id/somefile.txt HTTP/1.1", host: "example.com" 

所以现在nginx正在寻找正确的地方，但没有find任何东西。 像这个文件不是由PHP生成的？ 我正在与它斗争，不知道什么是战争…这是一个简单的任务restrcit位置，为什么这是行不通的？

EDIT3

这是如何看起来我的虚拟主机configuration现在：

 #example.com:443 server { listen 443 default; ssl on; ssl_certificate example.crt; ssl_certificate_key example.key; ssl_session_timeout 15m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl_prefer_server_ciphers on; server_name example.com; access_log /var/log/nginx/example.com.access.log; error_log /var/log/nginx/example.com.error.log; root /sites/public; location / { index index.php; if (!-f $request_filename) { rewrite ^.*$ /index.php last; break; } } location /restricteddir/download/file { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; } #PHP location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include /fastcgi_params; fastcgi_param SCRIPT_FILENAME /sites/public$fastcgi_script_name; } } server { listen 80 default; server_name example.com; access_log off; rewrite ^(.*)$ https://example.com$1 permanent; } 

所以我只把root指令移动到服务器块，之后，nginx正在寻找好的地方，但仍然geting 404。我很困惑，因为我注释掉location / restricteddir /下载/文件块一切正常，我可以下载文件。

对我来说，它是非常奇怪的，因为它只是一个简单的限制…为什么它启用后，Nginx无法find该文件…

 location / { root /sites/public; index index.php; if (!-f $request_filename) { rewrite ^.*$ /index.php last; break; } } 

 location / { try_files $uri $uri/ index.php?$args; } 

 server { … server_name example.com; access_log /var/log/nginx/example.com.access.log; error_log /var/log/nginx/example.com.error.log; root /sites/public; index index.php; 

 location /report/download/ { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include /fastcgi_params; fastcgi_param SCRIPT_FILENAME /sites/public$fastcgi_script_name; } 

 location /report/download/ { allow 192.168.0.0/16; allow 10.0.0.0/8; deny all; # The actual physical path on disk - alias /sites/public/restricteddir/download/; # or should this be the following? - # alias /restricteddir/download/; }