Hi folks,
TL; DR:
If the provided share.php and share_v2.php don't work on your setup:
- check your php.ini doesn't set cgi.fix_pathinfo to 0; if it does, either
remove the instruction or amend the scripts to strip
"strlen($_SERVER['SCRIPT_NAME'])+" from it
- if you use nginx as web server, take a look at this:
https://stackoverflow.com/questions/42751153/php-self-returns-index-php-index-php
: it seems there is (used to be?) a bug with nginx & php-fpm which causes
$_SERVER['PHP_SELF'] to contain incorrect values; both answers to the question
are interesting (the bug details and the quick fix)
Full blabla:
As discussed in the Prosody muc, the PHP scripts provided with
mod_http_upload_external didn't work directly with my config: the hash they
would give was always different from the one calculated by the mod.
It occurs that my $_SERVER['PHP_SELF'] string didn't contain the PHP file name,
only the uploaded file path.
Example:
PUT
/share_v2.php/wgXj4eDQVASlG02w/photos.zip?v2=7d9f2528957b92276c313fd53ba6c440a160c8074b804fbb9d2564d0a58cd509
gives the following:
$_SERVER['PHP_SELF'] = /wgXj4eDQVASlG02w/photos.zip (expected:
/prshare.php/wgXj4eDQVASlG02w/photos.zip)
$_SERVER['SCRIPT_NAME'] = /prshare.php
I first amended the scripts to take this into consideration, but after
investigation, it appeared that I once set the following variable to 0 in my
php.ini, and then totally forgot about it:
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not
grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs.
Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A
setting
; of zero causes PHP to behave as before. Default is 1. You should fix your
scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://php.net/cgi.fix-pathinfo
;cgi.fix_pathinfo=1
cgi.fix_pathinfo=0
Removing this assignment (I don't use CGI anyway) put my PHP_SELF variable back
in line with the standard, and then the original scripts worked…
During the investigation, I stumbled upon some nginx/php-fpm bug which could
also alter the contents of $_SERVER['PHP_SELF'], this time by doubling the
script name: the impact would be the same on the provided scripts, causing a
hash mismatch.
The Stack overflow question is there, which contains a link towards the bug
(reply 1) and a quick fix (reply 2) :
https://stackoverflow.com/questions/42751153/php-self-returns-index-php-index-php
The underlying bug report, supposedly solved, is there:
https://bugs.php.net/bug.php?id=55208
I don't use nginx myself, but I guess this could be of help to those who
mentioned issues with the scripts on this server…
Cheers,
Minami-o
--
You received this message because you are subscribed to the Google Groups
"prosody-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/prosody-dev.
For more options, visit https://groups.google.com/d/optout.
