Details
-
Improvement
-
Resolution: Obsolete
-
Medium
-
3.10.0alpha1, 3.8.8, 3.9.2, 4.2.0, 4.3.0, 4.4.0
-
None
Description
Hi,
If current eZP installation is Virtual Host
*We think that we should not allow requests like http://<host>/some_text/index.php
(but at present you can use any urls like http://<host>/YOU_CAN_TYPE_ANY_TEXT_HERE/index.php and ezp will work but not good)
*in this case
'some_text' will be parsed like wwwDir and will be added to all site's URI (like "/some_text/var/<...>/image.jpg") with ezurl, ezroot, ezdesign tpl operators.
!!So images, styles and other things will be broken.
(note: tpl operators work correctly!)
Moreover if someone goes to this eZP site with wrong URL
(e.g. http://host/some_text/index.php)
wrong site's URLs can be cached like 'cache-block'
and if another user goes to this site with CORRECT URL (e.g. http://host)
this user will get cached but WRONG URLs
(e.g. with 'some_text' string like wwwDir, => image/other urls will be started with 'some_text')
(note: pages with wrong URLs can be cached with static cache afterthat)
There are solutions:
- We should use
site.ini::[SiteAccessSettings].ForceVirtualHost=trueand url behaviour will be correct.
but it would be nice
if we can automatically understand what mode we are using (VirtualHost or nonVirtualHost) and fix this problem without manually setting changing.
Proposed fix:
Modified: projects/network/ezpublish/3.9/src/lib/ezutils/classes/ezsys.php
==============================================================================
--- lib/ezutils/classes/ezsys.php (original)
+++ lib/ezutils/classes/ezsys.php Thu Jul 26 17:08:35 2007
@@ -968,10 +968,33 @@
}
else
{
+ // Get wwwDir
if ( ereg( "(.*)/([^\/]+\.php)$", $scriptName, $regs ) )
$wwwDir = $regs[1];
else if ( ereg( "(.*)/([^\/]+\.php)$", $phpSelf, $regs ) )
$wwwDir = $regs[1];
+
+ /* If $wwwDir exists and current eZP installation is VH
+ * we should not allow requests like http://<host>/some_text/index.php
+ * because 'some_text' will be parsed like wwwDir (see code above: Get wwwDir)
+ * and will be added to all site's URI (like "/some_text/var/<...>/image.jpg").
+ * So images, styles and other things will be broken.
+ * Moreover if someone goes to this eZP site with wrong URL (e.g. http://<host>/wrongWWWDir/index.php)
+ * wrong site's URLs can be cached like 'cache-block'
+ * and if other user goes to this site with CORRECT URL this user will get cached wrong URLs (e.g. with 'wrongWWWDir' string like wwwDir)
+ */
+ if ( $wwwDir != '' )
+ {
+ /* Check difference between places where eZP installation is located + proposed wwwDir and executable path (without script file name)
+ * i.e. difference between DOCUMENT_ROOT + wwwDir and SCRIPT_FILENAME (without index.php)
+ * if there is no difference then we use nVH setup and $wwwDir should stay the same
+ * otherwise we use VH and we should clear $wwwDir.
+ */
+ $currentPath = substr( eZSys::serverVariable( 'SCRIPT_FILENAME' ), 0, -strlen( 'index.php' ) );
+ $docRoot = eZSys::serverVariable( 'DOCUMENT_ROOT' );
+ // $wwwDir will always have a slash as the first symbol, we should delete it
+ if ( ( $docRoot . substr( $wwwDir, 1 ) . '/' ) != $currentPath )
+ $wwwDir = '';
+ }
}
if ( ! $isCGI || $force_VirtualHost )
(perhaps we should replace ForceVirualHost with this patch because the fix does exactly the same as ForceVitualHost. So we definitely don't need both features in eZ Publish)
