-
Notifications
You must be signed in to change notification settings - Fork 7.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FPM with httpd ProxyPass does not decode script path #17645
Comments
I have been just looking into this more and it's slightly risky if anyone really has files saved in encoded way, then it might be tricky to keep it that way. I think it might be best to do this only in master and add a note to UPGRADING for this so will change this to feature. |
bukka
added a commit
to bukka/php-src
that referenced
this issue
Feb 22, 2025
This always decodes SCRIPT_FILENAME when Apache ProxyPass or ProxyPassMatch is used. It also introduces a new INI option fastcgi.script_path_encoded that allows using previous behavior of not decoding as there is a chance that some users could use encoded file paths in FS.
bukka
added a commit
to bukka/php-src
that referenced
this issue
Mar 2, 2025
This changes make FPM always decode SCRIPT_FILENAME when Apache ProxyPass or ProxyPassMatch is used. It also introduces a new INI option fastcgi.script_path_encoded that allows using the previous behavior of not decoding the path. The INI is introduced because there is a chance that some users could use encoded file paths in their file system as a workaround for the previous behavior. Close phpGH-17896
bukka
added a commit
to bukka/php-src
that referenced
this issue
Mar 15, 2025
This changes make FPM always decode SCRIPT_FILENAME when Apache ProxyPass or ProxyPassMatch is used. It also introduces a new INI option fastcgi.script_path_encoded that allows using the previous behavior of not decoding the path. The INI is introduced because there is a chance that some users could use encoded file paths in their file system as a workaround for the previous behavior. Close phpGH-17896
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
This makes ProxyPass and ProxyPassMatch inconsistent from SetHandler as well as usual nginx setup where script path is decoded.
If
space file.php
is:Then
curl 'http://localhost:8521/space%20file.php
results in 404. This is because the path is not decoded like it's done for other setups.This is kind of known issue but the inconsistency wasn't considered before and it really doesn't make much sense not to decode and it really seems like a bug for users. To be super safe we could consider fallback to the decoded path but it seems quite unlikely that anyone would rely on this.
It seems to me that people really use SetHandler more so similar issue there has been reported for ProxyPass I guess that its users probably just use normal file paths without special characters.
PHP Version
PHP 8.3+
Operating System
Linux
The text was updated successfully, but these errors were encountered: