How to filter all Apache URL containing string but

Question

I'm trying to filter all clients (using .htaccess) who try to access addresses containing for instance path=\ in the URL, but not those URL's that contain _wpnonce=1234567890.

The logic is: block all but those who also have the _wpnonce parameter.

The blocking, without testing if it contains the substring looks like this:

RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC,OR]

Is there a way to also include my substring negation there?

Answer 1

The documentation says that the pattern is a Perl-compatible regular expression, so you should be able to use a negative lookahead assertion:

RewriteCond %{QUERY_STRING} ^(?!.*_wpnonce=1234567890).*(menu|mod|path|tag)\=\.?/? [NC,OR]

though it might be clearer to put it in a separate RewriteCond, provided you can get all the [OR]s to work out. If it weren't for the [OR]s, you could just write:

RewriteCond %{QUERY_STRING} !_wpnonce=1234567890 [NC]
RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC]