mod_cgi/8683: requests for non-existent PHP files do not return a 404 error

[Steve Yates <su...@teamITS.com>]

>Number:         8683
>Category:       mod_cgi
>Synopsis:       requests for non-existent PHP files do not return a 404 error
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Mon Nov 05 13:40:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator:     support@teamITS.com
>Release:        1.3.19, 1.3.14
>Organization:
apache
>Environment:
The site www.teamits.com is running Rapidsite/Apa-1.3.14 (Unix) FrontPage/4.0.4.3 mod_ssl/2.7.1 OpenSSL/0.9.6 on IRIX

The site www.srtware.com is running mod_jk FrontPage/4.0.4.3 Confluence Apache/1.3.19 Ben-SSL/1.42 (Unix) on FreeBSD.
>Description:
It seems that if a browser requests a non-existent .php file,
the server returns an "internal server error" rather than a 404 error. 
I have duplicated this on multiple web servers.

Non-existent .php3 files are slightly different, they return:

Fatal error: Unable to open /u/web/teamit/test.php3 in - on line 0
No input file specified. 

It seems like Apache is handing the .php request to the php module
before checking to see if the file even exists...?
��������������������������������������������

Answer from RapidSite technical support:
----
This is because the handler gets precedence over the existence of the actual file. The handler sees the .php3 and then tries to parse the code. As far as Apache's concerned, the file existed - it returns a 200 result code because the handler was called successfully. 

If we were running PHP as an Apache module, this would likely be different, but we're not.

>How-To-Repeat:
www.teamITS.com/test.php
>Fix:
Have Apache check for the existence of a file before calling the CGI handler for PHP.
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]