This post originated from an RSS feed registered with PHP Buzz
by Forum One.
Original Post: Beware MultiViews with mod_negotiation and SyntaxCMS
Feed Title: Syntax Framework
Feed URL: http://blog.syntaxcms.org/rss.php?version=0.91
Feed Description: Finally, a place to answer Syntax questions
When trying to install SyntaxCMS on a new Debian server, I ran into a weird problem. Everything worked except SyntaxCMS's file-handling script. It works by taking a request, such as:
/files/123_file_mydoc.doc
and using a mod_rewrite rule to turn it into:
files.php?file=123_file_mydoc.doc.
files.php then checks to see if the current user (or anybody if the user isn't logged in) has permission to read that file, and then passes it through with the proper MIME types.
Well, it was churning and giving me a zero-length file. So I commented out that rewrite rule to verify that the rewrite was being performed. I expected a 404 error once I commented out the rule. However, it worked the same way!
So I commented out the other rules to make sure they were working properly. Sure enough, 404 errors were generated for most pages. So I went ahead and moved the entire .htaccess file out of the public root.
It still rewrote the /files/123_file_mydoc.doc request!
After much floundering and checking, Oscar and I figured out that mod_negotiation was on and that MultiViews was set.
Here's the relevant quote from the mod_negotiation docs:
A MultiViews search (enabled by the MultiViews Options), where the server does an implicit filename pattern match, and choose from amongst the results.
So it was taking any request in the form of /foo/whatever and mapping it to any file named foo.*, no matter the file extension. So foo.php would work, as would foo.txt.
The fix was to disable the MultiViews directive from Apache's configuration file and restart Apache--bingo! Everything worked.
So beware MultiViews when using fancy rewrite rules in your applications, as well as when you install SyntaxCMS.
Previous Topic
