You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/05/27 18:37:31 UTC
DO NOT REPLY [Bug 47273] New: ReWrite Rule fails on possible
"keywords"?!
https://issues.apache.org/bugzilla/show_bug.cgi?id=47273
Summary: ReWrite Rule fails on possible "keywords"?!
Product: Apache httpd-2
Version: 2.2.11
Platform: PC
OS/Version: Windows Vista
Status: NEW
Severity: major
Priority: P2
Component: mod_rewrite
AssignedTo: bugs@httpd.apache.org
ReportedBy: shehi@imanov.name
My .htaccess contains following ReWrite rule:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^acp/([\/-_a-z0-9\.]*) /index.php/acp/$1 [NC,QSA,L]
RewriteRule ^news/([\/-_a-z0-9\.]*) /index.php/news/$1 [NC,QSA,L]
</IfModule>
It works fine when I visit pages like:
http://URL.com/acp/components/
http://URL.com/acp/components/index.do
http://URL.com/acp/components/index.do?arg=value
http://URL.com/acp/components/register2.do
etc. However, 403 is issued when I try URL's such as these:
http://URL.com/acp/components/register.do
http://URL.com/acp/components/2register.do
http://URL.com/acp/components/getregister.do
And when I go to:
http://URL.com/acp/components/Register.do
I get redirected by 301 here:
http://URL.com/acp/index..do
IN ALL of my Apache conf files, there are no Aliases, VHosts or anything else
related to the keyword "register". I had this problem with some other keywords
as well, in the past, but I am afraid I don't remember them at this moment.
ANY help, support, tip, suggestion to solve, or at least identify this problem
is welcome!
Shehi
azerista-spam@yahoo.com [my public redundant email]
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47273] ReWrite Rule fails on possible "keywords"?!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47273
--- Comment #4 from Shehi <sh...@imanov.name> 2009-05-27 13:24:19 PST ---
Thanks guys. Problem fixed - my error because of prepending PERISHABLE PRESS 4G
BLACKLIST in .htaccess. Subject in question is as follows [for the future
reference]:
### PERISHABLE PRESS 4G BLACKLIST ###
# ESSENTIALS
RewriteEngine on
ServerSignature Off
Options All -Indexes
Options +FollowSymLinks
# FILTER REQUEST METHODS
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>
# BLACKLIST CANDIDATES
<Limit GET POST PUT>
Order Allow,Deny
Allow from all
Deny from 75.126.85.215 "# blacklist candidate 2008-01-02 =
admin-ajax.php attack "
Deny from 128.111.48.138 "# blacklist candidate 2008-02-10 = cryptic
character strings "
Deny from 87.248.163.54 "# blacklist candidate 2008-03-09 = block
administrative attacks "
Deny from 84.122.143.99 "# blacklist candidate 2008-04-27 = block clam
store loser "
Deny from 210.210.119.145 "# blacklist candidate 2008-05-31 = block
_vpi.xml attacks "
Deny from 66.74.199.125 "# blacklist candidate 2008-10-19 = block
mindless spider running "
Deny from 203.55.231.100 "# 1048 attacks in 60 minutes"
Deny from 24.19.202.10 "# 1629 attacks in 90 minutes"
</Limit>
# QUERY STRING EXPLOITS
<IfModule mod_rewrite.c>
RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
RewriteCond %{QUERY_STRING} tag\= [NC,OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} mosConfig [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|'|"|;|\?|\*).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%22|%27|%3C|%3E|%5C|%7B|%7C).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|config|localhost|loopback).*
[NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).*
[NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>
# CHARACTER STRINGS
<IfModule mod_alias.c>
# BASIC CHARACTERS
RedirectMatch 403 \,
RedirectMatch 403 \:
RedirectMatch 403 \;
RedirectMatch 403 \=
RedirectMatch 403 \@
RedirectMatch 403 \[
RedirectMatch 403 \]
RedirectMatch 403 \^
RedirectMatch 403 \`
RedirectMatch 403 \{
RedirectMatch 403 \}
RedirectMatch 403 \~
RedirectMatch 403 \"
RedirectMatch 403 \$
RedirectMatch 403 \<
RedirectMatch 403 \>
RedirectMatch 403 \|
RedirectMatch 403 \.\.
RedirectMatch 403 \/\/
RedirectMatch 403 \%0
RedirectMatch 403 \%A
RedirectMatch 403 \%B
RedirectMatch 403 \%C
RedirectMatch 403 \%D
RedirectMatch 403 \%E
RedirectMatch 403 \%F
RedirectMatch 403 \%22
RedirectMatch 403 \%27
RedirectMatch 403 \%28
RedirectMatch 403 \%29
RedirectMatch 403 \%3C
RedirectMatch 403 \%3E
RedirectMatch 403 \%3F
RedirectMatch 403 \%5B
RedirectMatch 403 \%5C
RedirectMatch 403 \%5D
RedirectMatch 403 \%7B
RedirectMatch 403 \%7C
RedirectMatch 403 \%7D
# COMMON PATTERNS
RedirectMatch 404 wp\_
Redirectmatch 403 \_vpi
RedirectMatch 403 \.inc
Redirectmatch 403 xAou6
Redirectmatch 403 db\_name
Redirectmatch 403 select\(
Redirectmatch 403 convert\(
Redirectmatch 403 \/query\/
RedirectMatch 403 ImpEvData
Redirectmatch 403 \.XMLHTTP
Redirectmatch 403 proxydeny
RedirectMatch 403 function\.
Redirectmatch 403 remoteFile
Redirectmatch 403 servername
Redirectmatch 403 \&rptmode\=
Redirectmatch 403 sys\_cpanel
RedirectMatch 403 db\_connect
RedirectMatch 403 doeditconfig
RedirectMatch 403 check\_proxy
Redirectmatch 403 system\_user
Redirectmatch 403 \/\(null\)\/
Redirectmatch 403 clientrequest
Redirectmatch 403 option\_value
RedirectMatch 403 ref\.outcontrol
# SPECIFIC EXPLOITS
RedirectMatch 403 errors\.
RedirectMatch 403 config\.
RedirectMatch 403 include\.
RedirectMatch 403 display\.
RedirectMatch 403 register\.
Redirectmatch 403 password\.
RedirectMatch 403 maincore\.
RedirectMatch 403 authorize\.
Redirectmatch 403 macromates\.
RedirectMatch 403 head\_auth\.
RedirectMatch 403 submit\_links\.
RedirectMatch 403 change\_action\.
Redirectmatch 403 com\_facileforms\/
RedirectMatch 403 admin\_db\_utilities\.
RedirectMatch 403 admin\.webring\.docs\.
Redirectmatch 403 Table\/Latest\/index\.
</IfModule>
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47273] ReWrite Rule fails on possible "keywords"?!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47273
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #1 from Eric Covener <co...@gmail.com> 2009-05-27 11:17:29 PST ---
Try starting a thread on the users mailing list, and be sure to include your
RewriteLog output and error log corresponding to the 403s.
http://httpd.apache.org/userslist.html
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47273] ReWrite Rule fails on possible "keywords"?!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47273
Ruediger Pluem <rp...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |INVALID
--- Comment #3 from Ruediger Pluem <rp...@apache.org> 2009-05-27 12:02:56 PST ---
Bugzilla is no user support forum but for reporting bugs. As Eric says please
go the users support mailing list. If it turns out to be a bug please come back
here and reopen the report.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47273] ReWrite Rule fails on possible "keywords"?!
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47273
Shehi <sh...@imanov.name> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |
--- Comment #2 from Shehi <sh...@imanov.name> 2009-05-27 11:55:07 PST ---
Dear Eric,
I wonder why the status and resolution of this report was changed. If this is a
problem which was reported before and has a solution to it, why not redirect me
to it? If not, then why change it as RESOLVED INVALID? Of course, I will
subscribe and post in Users list as well, but still, I would like to have an
answer to this question.
Deep regards,
Shehi
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org