Skip to content

FPM with httpd ProxyPass does not decode script path #17645

Closed

Description

@bukka

Description

This makes ProxyPass and ProxyPassMatch inconsistent from SetHandler as well as usual nginx setup where script path is decoded.

If space file.php is:

<?php
echo 1;

Then curl 'http://localhost:8521/space%20file.php results in 404. This is because the path is not decoded like it's done for other setups.

This is kind of known issue but the inconsistency wasn't considered before and it really doesn't make much sense not to decode and it really seems like a bug for users. To be super safe we could consider fallback to the decoded path but it seems quite unlikely that anyone would rely on this.

It seems to me that people really use SetHandler more so similar issue there has been reported for ProxyPass I guess that its users probably just use normal file paths without special characters.

PHP Version

PHP 8.3+

Operating System

Linux

Activity

  1. bukka commented on Feb 8, 2025

    @bukka
    MemberAuthor

    I have been just looking into this more and it's slightly risky if anyone really has files saved in encoded way, then it might be tricky to keep it that way. I think it might be best to do this only in master and add a note to UPGRADING for this so will change this to feature.

  2. added and removed on Feb 8, 2025
  3. added a commit that references this issue on Mar 15, 2025
    8fae6fc
  4. added a commit that references this issue on Mar 25, 2025
    5ff8d6d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions