Re: RewriteRule exposing system directories

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

Samuel Vogel wrote:
> It seems like Apache just forgets about the "../". A relative path to
> "../wcf/" called from "wbb.samy.domain.de" results in the following:
> [Thu Dec 13 21:26:24 2007] [error] [client 160.94.18.117] File does not
> exist: /data/apache/users/domain.de/samy/www/wbb/wcf, referer:
> http://wbb.samy.domain.de/
> 
> When I call "samy.domain.de/wbb" it works thou!

This is obvious, really.  You cannot go up past the root of
wbb.samy.domain.de.  Therefore to access wcf.samy.domain.de you'll have
to use the FQDN.  (Apache will map the request for
wbb.samy.domain.de/../wcf to wbb.samy.domain.de/wcf)

Accessing it through samy.domain.de means that you are accessing it from
the parent directory, therefore there is a ../wcf in relation to wbb.


> I turned on the RewriteLog, but the file stays emtpy:
> RewriteLog /data/apache/rewrite.log
> RewriteLogLevel 9
> 
> The rights on the file are as followed (and apache created it by itself):
> -rwxrwxrwx 1 www-data www-data 0 2007-12-13 20:20 /data/apache/rewrite.log
> 
> Does the errorlog snippet already contain enough information? If not so,
> then please hint me towards how to obtain the Rewrite log!
> 
> Regards,
> Samy
> 
> 
> Vincent Bray schrieb:
>> On 13/12/2007, Samuel Vogel <samy-delux@xxxxxx> wrote:
>>  
>>> I don't understand why it worked beforehand with my insecure
>>> RewriteRule.
>>> Also in my opinion mod_rewrite should/does not change the path, it just
>>> makes it appear different!?
>>>
>>> For example, when I call "samy.domain.de/wbb" it works, but
>>> "wbb.domain.kilu.de/" it does not work. Rewriting looks like this now:
>>>
>>> RewriteCond %{HTTP_HOST} !^www\.samy\.domain\.de
>>> RewriteCond %{HTTP_HOST} ^(www.)?([a-z0-9-]+)\.samy\.domain\.de
>>> RewriteRule (.*) %{DOCUMENT_ROOT}/%2/$1 [L]

To me this doesn't make sense.  All rewriting is relative to the
DocumentRoot anyway so you shouldn't have to include it in the
RewriteRule.  You can't use RewriteRule to map to arbitrary directories
in the filesystem.

I also really can't see why Apache would serve the contents of /etc if
you have your DocumentRoot set to /data/apache/users.  You don't have
your DocumentRoot set to / do you?

Assuming your DocumentRoot is set to /data/apache/users then all data
served will be from within there.

If you are going to continue to use the above RewriteConds then you'll
need to escape the '.' in the second one, otherwise www3, wwwx, etc.
will match.


>>> Why does this break relative paths?

Because they try to go above the root.

>> That's hard to say without seeing the rewrite log. I don't know if ../
>> would be interpreted as part of the path in this case (I would guess
>> not, but check your error log for the paths of your 404s).


				Neil.

-- 
Neil Hillard                    neil.hillard@xxxxxxxxxxxxxxxxxx
AgustaWestland                  http://www.whl.co.uk/

Disclaimer: This message does not necessarily reflect the
            views of Westland Helicopters Ltd.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
   "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx


[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux