Ian M. Evans
May 22, 2010 08:48AM
On 5/22/2010 8:24 AM, Igor Sysoev wrote:
> On Sat, May 22, 2010 at 08:13:58AM -0400, Ian M. Evans wrote:
>
>> On 5/22/2010 6:49 AM, Ian M. Evans wrote:
>>> On 5/22/2010 6:22 AM, Igor Sysoev wrote:
>>>> On Sat, May 22, 2010 at 06:17:26AM -0400, Ian M. Evans wrote:
>>>>> Yep, the two locations you suggested:
>>>>> location ~ ^/(?P<SN>cr...
>>>>> and
>>>>> location ~ ^(?P<SN>.*/(cr...
>>>> I can not reproduce. Do you use 0.8.37 ?
>>>
>>> Yes...I installed it last night and forgot to restart it, so the old
>>> version was still running. Once I finish banging my head on the desk,
>>> I'll disable the cgi.fix_pathinfo and make sure all is well.
>>>
>>> Thanks, and I'll let you know the results.
>>
>> Well, unfortunately, changing cgi.fix_pathinfo to cgi.fix_pathinfo=0
>> killed the extensionless php files, just like it did in 2008.
>>
>> Here's a snippet from the debug log when it works (cgi.fix_pathinfo=1):
>>
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http uri: "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http args: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http exten: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http process request header line
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: "/"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $pi to ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script copy: "PATH_INFO"
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http script var: ""
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:50:51 [debug] 24492#0: *1153 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:50:52 [debug] 24492#0: *1153 http fastcgi record length: 8184
>>
>> And here's the same request failing when cgi.fix_pathinfo is turned off:
>>
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http uri: "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http args: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http exten: ""
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "\.(shtml|php|inc)$"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^/(?P<SN>galleries)(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 test location: ~
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $pi to ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http regex set $sn to
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 using configuration
>> "^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var:
>> "/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param:
>> "SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script copy: "PATH_INFO"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http script var: ""
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 fastcgi param: "PATH_INFO: "
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: -4,
>> "/academy/75/photos?" a:1, c:2
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http upstream request:
>> "/academy/75/photos?"
>> ...
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http finalize request: 404,
>> "/academy/75/photos?" a:1, c:1
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 http special response: 404,
>> "/academy/75/photos?"
>> 2010/05/22 07:53:18 [debug] 24492#0: *1196 internal redirect:
>> "/dhe404.shtml?"
>>
>> Thanks for any suggestions. What I find interesting (mind-boggling?) is
>> that in both instances $pi, $sn, SCRIPT_FILENAME and PATH_INFO are the
>> same yet one succeeds and the other tosses a 404.
>
> If you request "/academy/75/photos/" with with cgi.fix_pathinfo=0,
> does it work ?
>
>

Adding the trailing slash still produced a 404.

2010/05/22 08:35:22 [debug] 24492#0: *1744 http uri: "/academy/75/photos/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http args: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http exten: ""
2010/05/22 08:35:22 [debug] 24492#0: *1744 http process request header line
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"\.(shtml|php|inc)$"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^/(?P<SN>cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|celebrityrow|torontofilmfestival)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^/(?P<SN>galleries)(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 test location: ~
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $pi to "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http regex set $sn to
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 using configuration
"^(?P<SN>.*/(cr|evans|news|poll|posters|photos|profile|review|shop|evansabove|test|profiles|reviews))(?P<PI>/.*$|$)"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy:
"SCRIPT_FILENAME"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var:
"/usr/local/apache/htdocs"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var:
"/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param:
"SCRIPT_FILENAME: /usr/local/apache/htdocs/academy/75/photos"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script copy: "PATH_INFO"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http script var: "/"
2010/05/22 08:35:22 [debug] 24492#0: *1744 fastcgi param: "PATH_INFO: /"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: -4,
"/academy/75/photos/?" a:1, c:2
2010/05/22 08:35:22 [debug] 24492#0: *1744 http upstream request:
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header: "Status:
404 Not Found"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header:
"X-Powered-By: PHP/5.2.5"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header:
"Content-type: text/html"
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi parser: 1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http fastcgi header done
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http upstream
request: 404
2010/05/22 08:35:22 [debug] 24492#0: *1744 finalize http fastcgi request
2010/05/22 08:35:22 [debug] 24492#0: *1744 free rr peer 1 0
2010/05/22 08:35:22 [debug] 24492#0: *1744 close http upstream
connection: 13
2010/05/22 08:35:22 [debug] 24492#0: *1744 event timer del: 13: 3221463051
2010/05/22 08:35:22 [debug] 24492#0: *1744 rtsig del connection: fd:13
2010/05/22 08:35:22 [debug] 24492#0: *1744 http finalize request: 404,
"/academy/75/photos/?" a:1, c:1
2010/05/22 08:35:22 [debug] 24492#0: *1744 http special response: 404,
"/academy/75/photos/?"
2010/05/22 08:35:22 [debug] 24492#0: *1744 internal redirect:
"/dhe404.shtml?"

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx
Subject Author Posted

nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:14PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Avleen Vig May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Eren Türkay May 25, 2010 11:44AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:36PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 01:44PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 01:52PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 02:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 02:40PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 21, 2010 03:10PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 04:46PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 04:58PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 21, 2010 05:20PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 21, 2010 05:54PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 02:10AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 01:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 01:32AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian Evans May 22, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 03:58AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 05:46AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:12AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 06:26AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:56AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:22AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Igor Sysoev May 22, 2010 08:30AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 08:48AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ian M. Evans May 22, 2010 06:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 21, 2010 03:50PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 23, 2010 11:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Jérôme Loyet May 24, 2010 03:00AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Weibin Yao May 24, 2010 04:20AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 09:00PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Grzegorz Sienko May 21, 2010 09:24PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 21, 2010 09:34PM

Re: nginx 0day exploit for nginx + fastcgi PHP

gdork January 26, 2011 11:07PM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 26, 2011 11:16PM

Re: nginx 0day exploit for nginx + fastcgi PHP

edogawaconan January 27, 2011 12:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike January 27, 2011 01:08AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Cliff Wells May 21, 2010 10:42PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Ding Deng May 22, 2010 09:28AM

Re: nginx 0day exploit for nginx + fastcgi PHP

mike May 22, 2010 03:30PM

Re: nginx 0day exploit for nginx + fastcgi PHP

brianmercer May 21, 2010 05:03PM

Re: nginx 0day exploit for nginx + fastcgi PHP

tuurtnt December 14, 2011 06:26PM

Re: nginx 0day exploit for nginx + fastcgi PHP

Kraiser February 17, 2012 09:53AM

Re: nginx 0day exploit for nginx + fastcgi PHP

Reinis Rozitis February 17, 2012 11:42AM

Re: nginx 0day exploit for nginx + fastcgi PHP

zsero October 30, 2012 01:01PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 221
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready