Contrib.social

Special Windows Filename Characters Break Apache on Windows

Open on Drupal.org →
Created on 24 August 2010, over 14 years ago
Updated 7 September 2023, over 1 year ago

Problem/Motivation

When using URL aliases the user is able to specify invalid filename sequences making the pages unloaded via those URLs.

Proposed resolution

To give the user warnings when saving these filenames. This will not prevent it but notify the user that there will be a future problem with them.
This patch will work on both Mac and Windows filesystems (change from original report).

Remaining tasks

Confirm the problem exists with a currently supported version of Drupal
Apply the patches.

User interface changes

None

API changes

None

Original report by CitizenKane

// Text of original report here.
When running Drupal on Apache (2.2) on Windows, sending Apache a URL with a special windows filename character (\ : * < >) will cause Apache to return a 403 or 404 error code depending on the specific combination of characters used. This can occur in URL aliases or menu routers paths. Apache will return the error before hitting Drupal in most cases, Apache is treating these as paths to files on the filesystem and is thus not allowing them to be passed in.

The path module should deal with these characters in some fashion, by filtering, transliteration or simply not allowing them.

🐛 Bug report
Status

Closed: outdated

Version

9.5

Component
Path  →

Last updated about 2 hours ago

  • Maintained by
  • 🇬🇧United Kingdom @catch
Created by

🇺🇸United States CitizenKane

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment almost 2 years ago →
    🇳🇿New Zealand quietone

    @CitizenKane. Thank you for reporting this problem. We rely on issue reports like this one to resolve bugs and improve Drupal core.

    Is this issue still a problem?

    There has been no activity here for 8 years. Has this perhaps been fixed in the meantime?

    I asked about this in #bugsmash. mstrelan replied that aliases such as foo:bar are allowed so this may not be fixed. They also pointed out that any fix, if made, should work for all OS's not just Windows.

    So, what we need next here is confirmation that the problem still exists. I have added that to the Issue Summary, remaining tasks. And I am setting the status to Postponed (maintainer needs more info) for that information.

  • Status changed to Closed: outdated over 1 year ago
  • Comment over 1 year ago →
    🇳🇿New Zealand quietone

    It has been 7 months since asking and there has been no confirmation that this problem exists on a supported version of Drupal.

    Therefore, closing as outdated. If this is incorrect reopen the issue, by setting the status to 'Active', and add a comment explaining what still needs to be done.

    Thanks!

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024