From 1b461200ccbad9368846c140013ee3370df14749 Mon Sep 17 00:00:00 2001
From: Eric Covener
Date: Thu, 29 Dec 2016 18:39:24 +0000
Subject: [PATCH] PR60009: RewriteRule local prefix checking update
*) mod_rewrite: When a substitution is a fully qualified URL, and the
scheme/host/port matches the current virtual host, stop interpreting the
path component as a local path just because the first component of the
path exists in the filesystem. Adds RewriteOption "LegacyPrefixDocRoot"
to revert to previous behavior. PR60009.
Submitted By: Hank Ibell
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1776463 13f79535-47bb-0310-9956-ffa450edef68
---
CHANGES | 7 +++++++
docs/manual/mod/mod_rewrite.xml | 19 +++++++++++++++++++
modules/mappers/mod_rewrite.c | 19 ++++++++++++++++++-
3 files changed, 44 insertions(+), 1 deletion(-)
diff --git a/CHANGES b/CHANGES
index a5f089c6e9..f6025e404e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,12 @@
-*- coding: utf-8 -*-
Changes with Apache 2.5.0
+
+ *) mod_rewrite: When a substitution is a fully qualified URL, and the
+ scheme/host/port matches the current virtual host, stop interpreting the
+ path component as a local path just because the first component of the
+ path exists in the filesystem. Adds RewriteOption "LegacyPrefixDocRoot"
+ to revert to previous behavior. PR60009.
+ [Hank Ibell ]
*) core: Add %{REMOTE_PORT} to the expression parser. PR59938
[Hank Ibell ]
diff --git a/docs/manual/mod/mod_rewrite.xml b/docs/manual/mod/mod_rewrite.xml
index 039d5bec5d..e6e53daf59 100644
--- a/docs/manual/mod/mod_rewrite.xml
+++ b/docs/manual/mod/mod_rewrite.xml
@@ -272,6 +272,25 @@ LogLevel alert rewrite:trace3
supply this extended context info. Available in 2.4.16 and later.
+
+ LegacyPrefixDocRoot
+
+
+ Prior to 2.4.25, if a substitution was an absolute URL that matched
+ the current virtual host, the URL might first be reduced to a URL-path
+ and then later reduced to a local path. Since the URL can be reduced
+ to a local path, the path should be prefixed with the document root.
+ This prevents a file such as /tmp/myfile from being accessed when a
+ request is made to http://host/file/myfile with the following
+ RewriteRule.
+
+ RewriteRule /file/(.*) http://localhost/tmp/$1
+
+ This option allows the old behavior to be used where the document
+ root is not prefixed to a local path that was reduced from a
+ URL. Available in 2.4.25 and later.
+
+
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index e026f38ca3..67d692a71b 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -202,6 +202,7 @@ static const char* really_last_key = "rewrite_really_last";
#define OPTION_INHERIT_DOWN_BEFORE (1<<7)
#define OPTION_IGNORE_INHERIT (1<<8)
#define OPTION_IGNORE_CONTEXT_INFO (1<<9)
+#define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
#ifndef RAND_MAX
#define RAND_MAX 32767
@@ -870,8 +871,15 @@ static void reduce_uri(request_rec *r)
/* now check whether we could reduce it to a local path... */
if (ap_matches_request_vhost(r, host, port)) {
+ rewrite_server_conf *conf =
+ ap_get_module_config(r->server->module_config, &rewrite_module);
rewritelog((r, 3, NULL, "reduce %s -> %s", r->filename, url));
r->filename = apr_pstrdup(r->pool, url);
+
+ /* remember that the uri was reduced */
+ if(!(conf->options & OPTION_LEGACY_PREFIX_DOCROOT)) {
+ apr_table_setn(r->notes, "mod_rewrite_uri_reduced", "true");
+ }
}
}
@@ -3026,6 +3034,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
else if (!strcasecmp(w, "ignorecontextinfo")) {
options |= OPTION_IGNORE_CONTEXT_INFO;
}
+ else if (!strcasecmp(w, "legacyprefixdocroot")) {
+ options |= OPTION_LEGACY_PREFIX_DOCROOT;
+ }
else {
return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
w, "'", NULL);
@@ -4804,6 +4815,7 @@ static int hook_uri2file(request_rec *r)
}
else {
/* it was finally rewritten to a local path */
+ const char *uri_reduced = NULL;
/* expand "/~user" prefix */
#if APR_HAS_USER
@@ -4839,7 +4851,12 @@ static int hook_uri2file(request_rec *r)
* because we only do stat() on the first directory
* and this gets cached by the kernel for along time!
*/
- if (!prefix_stat(r->filename, r->pool)) {
+
+ if(!(conf->options & OPTION_LEGACY_PREFIX_DOCROOT)) {
+ uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
+ }
+
+ if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
int res;
char *tmp = r->uri;
--
2.40.0