diff --git a/apache/manual_form.cgi b/apache/manual_form.cgi
index 9554cc2bf..b9e03806d 100755
--- a/apache/manual_form.cgi
+++ b/apache/manual_form.cgi
@@ -35,6 +35,7 @@ if (defined($in{'virt'})) {
 		}
 	}
 else {
+	&allowed_auth_file($in{'file'}) || &error($text{'htindex_ecannot'});
 	if (defined($in{'idx'})) {
 		# files within .htaccess file
 		$hconf = &get_htaccess_config($in{'file'});
diff --git a/apache/manual_save.cgi b/apache/manual_save.cgi
index b6306b511..731229c1f 100755
--- a/apache/manual_save.cgi
+++ b/apache/manual_save.cgi
@@ -34,6 +34,7 @@ if (defined($in{'virt'})) {
 		}
 	}
 else {
+	&allowed_auth_file($in{'file'}) || &error($text{'htindex_ecannot'});
 	if (defined($in{'idx'})) {
 		# files within .htaccess file
 		$hconf = &get_htaccess_config($in{'file'});