Re: php scripts and tripple slashes


mijn naam schreef:
"Erwin Moller" <Since_humans_read_this_I_am_spammed_too_much@xxxxxxxxxxxxxxxx> schreef in bericht news:48e0ebcb$0$187$e4fe514c@xxxxxxxxxxxxxxxxx

http://hostname/debug/one/two///three/four

in other words: http://{$_SERVER["SERVER_NAME"]}{$_SERVER["REQUEST_URI"]}

OK, that makes sense then for $_SERVER["REQUEST_URI"].

I don't see how/why PHP fills $_SERVER["PHP_SELF"] with:
/debug/one/two/debug.php/one/two/three/four
for that URL if you don't play with mod_rewrite.

I'm sure I disabled mod_rewrite. At the server restart, apache complained "Invalid command 'RewriteLog', perhaps mis-spelled or defined by a module not included in the server configuration" ( I forgot to remove one such line at first).


Your url:
http://hostname/debug/one/two///three/four
DOESN'T name any php script, so HOW is this fed to a PHP script without mod_rewrite???

the php script is debug.php ...

Are you sure you are telling the whole story?

... and apache is setup with options MultiViews. I didn't hide that on purpose.

Aaah, Multiviews.
You should have mentioned that earlier.
That must be your problemobfuscator. ;-)

This is what my apache2 tell me (PHP5) when I request:
http://www.example.com/test.php/one///two/three

[REQUEST_URI] => /test.php/one///two/three
[PHP_SELF] => /test.php/one///two/three

And I don't use Multiviews.

As you can see, both URI and PHP_SELF contain what you (or at least I) expected.

I am no expert on Multiviews, but I expect your problem originates there. Maybe you can configure them differently, or use mod_rewrite instead if that is an option.
(You can mimic your desired multiview behaviour with mod_rewrite if you just think up a smart match for the url.)

Good luck.

Regards,
Erwin Moller




What about simply dismissing a request that has more than one / in the URL?
That must be an invalid request, since (I expect) you deliver the directorylinks yourself, and thus correctly formatted.

That would also be an option. However: nobody's perfect, a mistake is easily made e.g. $ptr="./{$dir}/{$path}"; what if path starts with a slash, dir starts or ends with a slash, dir is empty, and so on. Apache couldn't care less and will happily serve .///something/different.html




--
============================
Erwin Moller
Now dropping all postings from googlegroups.
Why? http://improve-usenet.org/
============================
.

Relevant Pages

  • Re: php scripts and tripple slashes
    ... complained "Invalid command 'RewriteLog', perhaps mis-spelled or defined by a module not included in the server configuration". ... Apache couldn't care less and will happily serve .///something/different.html ... I've stayed out of this thread because I'm hazy on this, but you should be aware that serving two slashes will be interpreted differently than what you want, it is not directory separator. ... Not on the apache servers I'm dealing with. ...
    (comp.lang.php)
  • Re: PHP - HTML
    ... Some sort of rewrite? ... Probably easiest with Apache's MultiViews (assuming you use Apache, ...
    (comp.lang.php)
  • Syntax error on line 173 of C:/Program Files/Apache Group/Apache2/conf/httpd.conf: Invalid command p
    ... Invalid command 'php5_module', perhaps mis-spelled or defined by a module ... I am using apache 2.0.59 and php 5.1.6 I am on win98se and my apache monitor ... the httpconf file but still no luck, I am at a loss on what to do next ...
    (alt.php)
  • Re: php scripts and tripple slashes
    ... "Invalid command 'RewriteLog', perhaps mis-spelled or defined by a module not included in the server configuration". ... DOESN'T name any php script, so HOW is this fed to a PHP script without mod_rewrite??? ... and apache is setup with options MultiViews. ...
    (comp.lang.php)
  • Re: Apache Artificially Long Slash Path Directory ListingVulnera bility -- FILE READ ACCESS
    ... Apache Artificially Long Slash Path Directory ListingVulnera bility -- FILE READ ACCESS ... Tested & Vulnerable apache 1.3.4 on bsdi 4.0 ... Turned off "MultiViews" & now we're not vulnerable. ... >>> Please let me know if you duplicate this success on any other platforms. ...
    (Bugtraq)