mod_cgi/4115: CGI Execs properly from ScriptAlias Directory, Error 500 anywhere else.

[Michael Edenfield <ku...@cyber-wizard.com>]

>Number:         4115
>Category:       mod_cgi
>Synopsis:       CGI Execs properly from ScriptAlias Directory, Error 500 anywhere else.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Mar 24 13:40:01 PST 1999
>Last-Modified:
>Originator:     kutulu@cyber-wizard.com
>Organization:
apache
>Release:        1.3.6
>Environment:
OS: Linux scorpion 2.0.36 #8 Sun Mar 14 17:32:01 EST 1999 i686 unknown
gcc: 2.8.1
libc: glibc2.0.6
>Description:
Attempting to set up cgi-bin directories for each user, I followed the directions in the FAQ.  I put these directives into my httpd.conf:

----- Start httpd.conf excerpt -----
ScriptAlias /cgi-bin/ /usr/html/cgi-bin/

<Directory /usr/html/cgi-bin>
  Options +ExecCGI
  AllowOverride None
  Order allow,deny
  Allow from all
</Directory>

UserDir public_html

<Directory /home/*/public_html>
    AllowOverride FileInfo AuthConfig Limit Options
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    <Limit GET POST OPTIONS PROPFIND>
        Order allow,deny
        Allow from all
    </Limit>
    <Limit PUT DELETE PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
        Order deny,allow
        Deny from all
    </Limit>
</Directory>


AddHandler cgi-script .cgi

<Directory /home/*/public_html/cgi-bin>
  Options +ExecCGI
  AllowOverride None
  Order allow,deny
  Allow from all
</Directory>

------ END httpd.conf excerpt -----

The server does execute the file from both the ~user/cgi-bin URL and /cgi-bin URL, but from ~user/cgi-bin it generates the error about "Premature end of script headers", while from /cgi-bin it works correctly.  This can be repeated with the test-cgi sh script, the printenv PERL script, and my own test TCL script.  I have turned off all output buffering via $| or fconfigure (respectively), and tested from the command line to confirm that
Content-Type: text/html

is in fact printed to stdout.
>How-To-Repeat:
http://www.mcramerica.com/cgi-bin/test.cgi
http://www.mcramerica.com/~kutulu/cgi-bin/test.cgi
http://www.mcramerica.com/kutulu/test.cgi 

This is test-cgi, shipped with Apache, renamed to test.cgi, and cp'd into the directories.  Both have permissions 0755.  The third URL also works, (see below), and is the same physical file (/home/kutulu/public_html/cgi-bin/test.cgi) as the second URL.
>Fix:
Currently, I can fix the problem by using ScriptAlias to define a cgi-bin alias for each user with cgi, as in:

ScriptAlias /kutulu/ /home/kutulu/public_html/cgi-bin/

>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]