I'm trying to filter all clients (using .htaccess) who try to access addresses containing for instance path=\ in the URL, but not those URL's that contain _wpnonce=1234567890.
The logic is: block all but those who also have the _wpnonce parameter.
The blocking, without testing if it contains the substring looks like this:
RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC,OR]
Is there a way to also include my substring negation there?
The documentation says that the pattern is a Perl-compatible regular expression, so you should be able to use a negative lookahead assertion:
RewriteCond %{QUERY_STRING} ^(?!.*_wpnonce=1234567890).*(menu|mod|path|tag)\=\.?/? [NC,OR]
though it might be clearer to put it in a separate RewriteCond, provided you can get all the [OR]s to work out. If it weren't for the [OR]s, you could just write:
RewriteCond %{QUERY_STRING} !_wpnonce=1234567890 [NC]
RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC]
