Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rewrite Engine 重写(伪静态)解释 #53

Closed
YieldRay opened this issue May 5, 2020 · 5 comments
Closed

Rewrite Engine 重写(伪静态)解释 #53

YieldRay opened this issue May 5, 2020 · 5 comments
Labels
attention pay attention

Comments

@YieldRay
Copy link

YieldRay commented May 5, 2020

Platform: VPS/Apache
when I use this .htaccess below

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*) index.php?/$1 [L]

This should work, but when installing, it returns a 200 error and does not show the password form.
It seems there are some problem when checking the Rewrite Engine.

@qkqpttgf
Copy link
Owner

qkqpttgf commented May 6, 2020

I had a .htaccess file, use it!
Your code mean viewer can access your local files, like xxxx.com/theme or xxxx.com/config.php , you must read my readme.md in github,
In my .htaccess, viewer can not visit any local files.
The 200 http code mean you can visit config.php, if the right Rewrite works, it must 201 (the 'click to install' page).
我有一个.htaccess文件你不看,你不用??还要自己弄一个。
你的重写代码意思是,不存在这个文件(夹)的时候,才会重写,才会给程序处理,这样会暴露程序文件。当onedrive中正好也有这个文件(夹)的时候,你永远访问不了onedrive中的那个,你只能访问到代码中的文件(夹),这样会造成安全隐患。
200的意思是你正常访问到了config.php,说明没有经过重写,这对我程序来说是不可原谅的,我需要所有的访问都交由index.php来处理,按程序要求,安装时访问config.php应该要201状态码(这正是“点击安装”页面的状态码)。

@qkqpttgf qkqpttgf pinned this issue May 6, 2020
@qkqpttgf qkqpttgf changed the title Some problem when checking the Rewrite Engine Rewrite Engine 重写(伪静态)解释 May 6, 2020
@YieldRay
Copy link
Author

YieldRay commented May 6, 2020

The fact is, after installing I changed .htaccess to my own, It did work. (If I have local files, I can view my own but not files in onedrive. I can add more Rewrite Rules to avoid exposing files for the program.)

In your codes, you check the config.php to check the Rewrite Engine(You give both js and php method then use js). This is inappropriate in some cases. You need to give users some choices(Like A button to skip the check).

If you want to avoid safety problems, I'd recommend you not using cookies(replace with localStorage/sessionStorage).

@qkqpttgf
Copy link
Owner

qkqpttgf commented May 6, 2020

No, I think everything the viewer can visit is in onedrive,I will hide local files.
The xxxxx.com/folder/file only point to the file in onedrive, that is conformable to thought.

@YieldRay
Copy link
Author

YieldRay commented May 6, 2020

I must say that your .htaccess is a bit strange, because usually router is to give priority to local files.

@qkqpttgf
Copy link
Owner

qkqpttgf commented May 6, 2020

I must say that your .htaccess is a bit strange, because usually router is to give priority to local files.

I say, any visit must point to onedrive !!!

@qkqpttgf qkqpttgf added the attention pay attention label Mar 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
attention pay attention
Projects
None yet
Development

No branches or pull requests

2 participants