Ticket #183 (closed defect: fixed)

Opened 3 years ago

Last modified 3 days ago

http://domain.com/symlink.php/ returns PHP source code instead of executing it.

Reported by: mpb.mail@… Owned by: jan
Priority: highest Milestone:
Component: mod_fastcgi Version: 1.4.13
Severity: normal Keywords:
Cc: Blocked By:
Need User Feedback: no Blocking:

Description

Create page.php:

<?php
print 'PATH_INFO: '. $_SERVER['PATH_INFO']. "<br>\n";
print 'ORIG_PATH_INFO: '. $_SERVER['ORIG_PATH_INFO']. "<br>\n";
?>

Then create a symbolic link with "ln -s page.php symlink.php".

Then compare:

http://domain.com/page.php/
http://domain.com/symlink.php/

The first will execute page.php, as expected.

The second returns the source code for symlink.php (as a file of type "BIN" that you need to save somewhere). This is wrong. It should execute the source code instead.

I'm running LightTPD 1.3.15 and PHP 5.0.4 via FastCGI on FreeBSD 5.3.

Additionally, the new ticket form does not list 1.3.15 as a version of LightTPD. It only lists 1.3.14 and 1.3.x-svn.

Attachments

Change History

Changed 3 years ago by uros@…

  • version changed from 1.3.14 to 1.3.15

I confirm this on lighttpd-1.3.16, freeBSD 5.4 and php 5.0.4

Changed 8 months ago by ewlloyd@…

  • version changed from 1.3.15 to 1.4.13
  • pending unset

Observed on 1.4.13 (Debian package, built 2008.10.04.

Bump.

Changed 7 months ago by anonymous

  • priority changed from normal to highest

Changed 6 months ago by stbuehler

  • pending set

Please attach a (small) config which reproduces the problem.
Works for me with 1.4.18.

Changed 6 months ago by mpb.mail@…

  • pending unset

As of 1.4.15 the problem seems to be fixed.

Changed 6 months ago by stbuehler

  • status changed from new to closed
  • resolution set to fixed

Changed 6 months ago by ewlloyd@…

I bumped this bug back in January, when a fresh Debian install exhibited the problem. Last night, the problem disappeared for no apparent reason. I haven't been able to reproduce it in the VM where I first found it, and I didn't have the foresight to maintain a snapshot before it disappeared.

I'll attempt to reproduce it in a fresh VM, and will reopen the ticket if I'm successful.

Add/Change #183 (http://domain.com/symlink.php/ returns PHP source code instead of executing it.)

Author



Change Properties
<Author field>
Action
as closed
Next status will be 'reopened'
 
Note: See TracTickets for help on using tickets.