Hello,
the exact explanation for the Allow/Deny ordering is:
Order: The order that the server follows to check if access is granted to a
client based on its IP address. If it is set to Allow/Deny, access is denied by
default and is allowed only if the IP address is in the Allow for list and is
not in the Deny for list. If it is set to Deny/Allow, access is allowed by
default and is denied only if the IP address is in the Deny for list and is not
in the Allow for list.
So what you want is to allow /cgi-bin but not to a protected directory inside of it.
Then you will need to use Deny/Allow.
That means you can access anything within /cgi-bin unless it's in the Deny list.
This way you put /cgi-bin in Allow and /cgi-bin/protect in Deny.
However your CGI PowerBasic code looks risky to me.
You use a literal arbitrary string that gets executed as a command against your database.
This could enable malicious links with intentionally malformed queries to corrupt your DB.
You want to let users download a specific recordset, so you you should 'shim' a new API and hide the SQL queries behind it:
Hardcode a list of keywords in a conditional table such as a Select statement.
Then if the keyword is like:
https
://your-website/cgi-bin/get-records-set.exe?id=parts
Then you manually yourself run the appropriate query statement against your database.
This way you don't give any chance for attackers to give trick query strings to your server.
So I mean that you need not to execute anything the visitor gives you even if authenticated.
For downloading big files, you might want to create a restricted directory then implement X-Sendfile.
Basically you create a restricted folder to put downloadable files inside, and you deny remote access to it.
When authorized users want to download, in your CGI program you will be able to simply return the X-Sendfile header with the literal real path to the requested file.
Then Abyss itself will terminate the CGI script and start returning the file to the visitor.
You can do any checks you want first, then start returning X-Sendfile heades only when authorized.
Abyss only takes over the CGI session when it intercepts this header while X-Sendfile support is enabled.
For big files, it's worth thinking about it I think.