URLs containing /index.php/ as subdirectory show content of index.php - apache

I have a clean installation of Apache+PHP (latest) on CentOS 8 with no customization on php.ini nor .htaccess files. For some reason when I open URLs like:
https://www.example.com/index.php/xxxx/flkjfd.jpg
https://www.example.com/index.php/SLkfjLj/
https://www.example.com/index.php/9kf944.994
They always show the content of the index.php file located at the root. If I remove that file, than the URLs above show 404 error. How can this happen? I have no directory "index.php"! I have only a file "index.php" with some random string... How can I prevent this?
Isnt this weird? Or is this expected?

Related

Redirect a forbidden URL in Apache

I would like to move an entire directory and its subdirectories from one Apache server A to another Apache server B, and then create a redirection from A to B.
i.e.
http://server_a.com/docroot/dir to http://server_b.com/docroot/dir.
This is what I did:
I copied the files and directory structure under dir from A to B
I deleted the directory dir on A
I created a rule in docroot/.htaccess on server A that reads
Redirect permanent dir/ http://server_b.com/docroot/dir/
But when I go to http://server_a.com/docroot/dir/path/to/file/index.html, I get a 403 Forbidden, even if the target page http://server_b.com/docroot/dir/path/to/file/index.html is up.
I know that the .htaccess is read by Apache, because it correctly controls other parts of server_a. I am not root on these servers. I have also tried with a RewriteRule, with the exact same results.
How should I go about creating a redirect in this case? Thanks.
If you have mod_rewrite enabled than you can do this
RewriteEngine On
RewriteRule ^/?docroot/dir(/.*)?$ http://server_b.com/docroot/dir$1 [R=301,L]
Put it in your .htaccess file in the Document Root directory http://server_a.com/.
Note:
Delete you Browser cache first.
You'll need the leading / in the old URL. Like this:
Redirect permanent "/dir" "http://server_b.com/docroot/dir/"
See the mod_alias docs for more details.

Which ErrorDocument request will take precedence?

I have a domain which contains within it multiple sites with multiple .htaccess files (it's for clients to check their own projects out before they go live to their own servers, so each .htaccess file controls its own site).
If I have a .htaccess file in the root, it will control the domain. If mydomain.com/doesntexist is entered and it doesn't exist, the root's 404 page will come up. If mydomain.com/doesexist/doesntexist is entered, the .htaccess file in the "doesexist" directory would take priority, as opposed to the root's .htaccess file ... correct?
You are correct.
I suggest you to read Apache HTTP Server Tutorial: .htaccess files
The configuration directives found in a .htaccess file are applied to
the directory in which the .htaccess file is found, and to all
subdirectories thereof. However, it is important to also remember that
there may have been .htaccess files in directories higher up.
Directives are applied in the order that they are found. Therefore, a
.htaccess file in a particular directory may override directives found
in .htaccess files found higher up in the directory tree. And those,
in turn, may have overridden directives found yet higher up, or in the
main server configuration file itself.
ROOT htaccess
ErrorDocument 404 /index.php
subfolder htaccess
ErrorDocument 404 /subfolder/index.php
http://domain.com/does_not_exist --> (404 error) /index.php
http://domain.com/subfolder/does_not_exist --> (404 error) /subfolder/index.php

Shutting down a website using HTaccess does not work

OK, it's very simple but it does not work. I have a wiki site where the root contains an index.php file and the subdirectories contains the content of the wiki (I use PMwiki, so no database is required)
I want to temporarity shutdown the website and make it unaccessible by using an nice HTML page to display the shutdown message. I could rename the index.php file, but the rest of the files in the subfolder will remain accessible.
The first thing that worked but which is not elegant is restricting the whole site with a password in the htaccess using "Require valid-user" and all it's other command. The problem is that I cannot display a nice shutdown message as an HTML file.
Else I tried renaming the index.php file to something else like site.php. Creating a index.html file as a message and using a script like this:
Order Deny, allow
Deny from all
<File "index.html">
Allow from all
</File>
In that case, the index.html file is accessible, but it must be manually typed in the URL, it will not use this file by default. I tried adding DirectoryIndex directive like this
DirectoryIndex index.html
But it still does not work.
So first is there a way to make the user only see 1 page in particular and block everything else.
Second, doing so makes the site unaccessible to me. So is there a way to passords restrict the whole directory structure except for a specific index.html file. So that I could type url/site.php and be able to enter my website using an htaccess password.
Thanks for any help
Just this rule in root .htaccess should be able to handle this:
RewriteEngine On
RewriteBase /
RewriteRule !^shutdown\.html$ shutdown.html [L,NC]
Now you can keep custom HTML content in /shutdown.html. Keep in mind you need to use inline css/js since it will also rewrite css/js requests to /shutdown.html file.

Apache: Missing folders rewritten to php-files

I have a site with the url http://localhost/my-site/. A file called test.php exists on root, a folder named test does not exist.
When I open a link like http://localhost/my-site/test/, the file test.php is opened. Should it not give a 404 error instead? I have no .htaccess file doing any funny business. The rewriting seems to be done before any .htaccess file is being run, as a rewrite rule of test/ does not match anything. A rewrite rule of test.php does however match.
I am using WampServer 2.2 with Apache 2.4.2.
This sounds like a mod_negotiation/Multiviews issue.
In the appropriate place (say, in your vhost config, or in the htaccess file in my-site's directory, include in the Options a - multiviews:
Options -Multiviews

Joomla | enabling SEF removes index.php, but returns a 404 page. Page visible thru index.php/page. How to fix?

I'm running Joomla 2.5.8 and I'm trying to delete the stupid index.php so having SEO friendly URLs. Yet.. When enabled and rebuild' the menu, when I click on a menu item the site goes to the page without the /index.php/ BUT it returns a 404 page. However, when I manually type /index.php/ between the domain and the page, I see the normal page.
A few notes
I changed htaccess.txt to .htaccess
I removed the '#' before RewriteBase /
I added 'cms' to the directory path (RewriteBase /cms ) Since Joomla is in the /cms folder
However, the htaccess is in the SAME folder as Joomla itself, they both lie in a subfolder
In the root folder, where a different website is stored, there also lies a .htaccess file
Any suggestions guys?
Thanks!
Sounds like your config is OK.
The htaccess with RewriteBase /CMS, should be in the /CMS folder.
In Joomla you should have sef rules enabled and use mod_rewrite option enabled.
This could simply be a cache clearing issue.