Hi Francis,

> > Original dirs exclusion:
> > location ~ /(data|conf|bin|inc)/ {
> > deny all;
> > }
> >
> > Of course, this won't work w/ my changes,
>
> ....why "of course"?

I'm cursed w/ IT & electronics: they hate me,
I must have pissed off Murphy in another live:):(

> The original example wanted to block access to
> /data/ and
> /something/data/; you now want to block access to
> /dokuwiki/data/
> and /dokuwiki/something/data/.
>
> This location block will match all of those
> (depending on what else is
> in your config file).
>
> > In my mind it _should_ be: "location
> ~/dokuwiki/(data|conf|bin|inc)/"
>
> That looks to me like it should also work...

Yep, I read the docs and found a useful link toward
perl regexps, so I thought this would have worked
(I must say I didn't understand it fully: eg: at this time
I don't really know the difference between .* and (.*) ).

> What one url did you access to test this?

conf say: root mydyndnsdom.org
(I've set an authoritative zone for it in the LAN,
returning: 192.168.1.50)
I access it by: http://mydyndnsdom.org

> What response did you see?

192.168.1.50 - - [30/Jun/2012:07:37:40 +0200] "GET /dokuwiki/lib/tpl/default/images/button-dw.png HTTP/1.1" 444 0 "http://mydyndnsdom.org/install.php" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.16) Gecko/20120603 Iceape/2.0.11"

444 is what I intend to use when stable; however, for
tests my block is:
location ~ /dokuwiki/(data|conf|bin|inc)/ {
return 403;
}

> What response did you expect to see?

a 200 one

> If you provide your config file, or at least the
> full list of top-level
> location definitions, someone may be able to point
> out why the second
> and third answers differ.

server_name mydyndnsdom.org;
root /var/www;
listen 80;
index doku.php;

location ~ \.php$ {
if (!-f $request_filename) {
return 403;
}
include fastcgi_params;
fastcgi_index doku.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# PB: Sometimes a 400 is returned
# SOLT: http://forum.dokuwiki.org/thread/4855
fastcgi_pass unix:/var/run/php5-fpm.socket;
}

# Common conf file between HTTP & HTTPS confs
include /etc/nginx/sites-available/mydyndnsdom.org_DOKUWIKI_http_https_COMMON.conf;

========

in COMMON file:

location ~ /dokuwiki/(data|conf|bin|inc)/ {
return 403;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires 30d;
access_log off;
log_not_found off;
}

location /dokuwiki {
location / {
index doku.php;
try_files $uri $uri/ @dokuwiki;
}

location @dokuwiki {
rewrite ^/dokuwiki/_media/(.*) /lib/exe/fetch.php?media=$1 last;
rewrite ^/dokuwiki/_detail/(.*) /lib/exe/detail.php?media=$1 last;
rewrite ^/dokuwiki/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
rewrite ^/dokuwiki/(.*) /doku.php?id=$1&$args last;
}

> http://nginx.org/r/location

This matches the link I read about regexps.

> Does the example config in
> http://bugs.dokuwiki.org/index.php?do=details&task
> _id=2388 provide any
> useful hints?

Oh, I see; but there's something strange: he only modify one path;
but others nest in the same place, so he logically should have
split the original block in 4 blocks, no? (last post).

> Good luck with it,

Thanks.

This night, I found that the unstable Debian pkg (last version)
also fit into stable branch, so I flipped in it (easier maintenance).

Now, I'm gonna restart and modify my nginx conf+DW
according to all information you gave me.

I'll keep you aware about the issue.