Re: RewriteRule exposing system directories

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



It seems like Apache just forgets about the "../". A relative path to "../wcf/" called from "wbb.samy.domain.de" results in the following: [Thu Dec 13 21:26:24 2007] [error] [client 160.94.18.117] File does not exist: /data/apache/users/domain.de/samy/www/wbb/wcf, referer: http://wbb.samy.domain.de/

When I call "samy.domain.de/wbb" it works thou!

I turned on the RewriteLog, but the file stays emtpy:
RewriteLog /data/apache/rewrite.log
RewriteLogLevel 9

The rights on the file are as followed (and apache created it by itself):
-rwxrwxrwx 1 www-data www-data 0 2007-12-13 20:20 /data/apache/rewrite.log

Does the errorlog snippet already contain enough information? If not so, then please hint me towards how to obtain the Rewrite log!

Regards,
Samy


Vincent Bray schrieb:
On 13/12/2007, Samuel Vogel <samy-delux@xxxxxx> wrote:
I don't understand why it worked beforehand with my insecure RewriteRule.
Also in my opinion mod_rewrite should/does not change the path, it just
makes it appear different!?

For example, when I call "samy.domain.de/wbb" it works, but
"wbb.domain.kilu.de/" it does not work. Rewriting looks like this now:

RewriteCond %{HTTP_HOST} !^www\.samy\.domain\.de
RewriteCond %{HTTP_HOST} ^(www.)?([a-z0-9-]+)\.samy\.domain\.de
RewriteRule (.*) %{DOCUMENT_ROOT}/%2/$1 [L]

Why does this break relative paths?

That's hard to say without seeing the rewrite log. I don't know if ../
would be interpreted as part of the path in this case (I would guess
not, but check your error log for the paths of your 404s).


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx


[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux