Fix bug #74205 PATH_INFO only partial support

[remicollet]

I tried but failed to find why this "dot" breaks redirection, so I propose to clean it.
Notice: static files are managed in php_cli_server_dispatch

As this may introduce a behavior change, I only propose this for 7.2

Open for discussion.

See https://bugs.php.net/74205

[remicollet]

Also fix https://bugs.php.net/74061

[nikic]

Looks like this was introduced in 8d46756, but it's not clear why, or how it is related to that change (which seems to be about slashes).

[remicollet]

indeed.
@laruence as you're the author of 8d46756 can you please have a look (yes this is quite old)

[remicollet]

Hmm... I see a case

/index.php
/img/foo.png

/img/bar.png should (perhaps) return a not found error.. will try to think if a better way is possible

[remicollet]

A mnimal fix, allowing dot not in final part is

diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 62e1601..a3ff6e8 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -1382,6 +1382,9 @@ static void php_cli_server_request_translate_vpath(php_cli_server_request *reque
        }
        q = request->vpath + request->vpath_len;
        while (q > request->vpath) {
+               if (*q == '/') {
+                       break;
+               }
                if (*q-- == '.') {
                        is_static_file = 1;
                        break;

[remicollet]

After a bit more thinking on this, and lot of try I think we cannot have a safe way to known if you should redirect or not.

Another exampple /foo/index.php/bar ?

So, here is another proposal (which should be very simple)

• without new --redirect option, current behavior is unchanged, redirect only occurs if no dot in URI
• with new --redirect option, everything not found is redirected to index.php (and PATH_INFO is set)

This new option is designed to be a real equiv to Apache rules:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [QSA,L]

See the new test for this change.

[nikic]

Isn't --redirect effectively equivalent to specifying a routing script with a if (file_exists) return false; check at the top?

[remicollet]

@nikic not exactly, a possible router script will be (a bit ugly)

<?php
if ($_SERVER['SCRIPT_FILENAME'] !== basename(__FILE__)) {
	return false;
}
$_SERVER['PATH_INFO']       = $_SERVER['SCRIPT_NAME'];
$_SERVER['SCRIPT_FILENAME'] = __DIR__ . "/index.php";
$_SERVER['SCRIPT_NAME']     = "/index.php";
require $_SERVER['SCRIPT_FILENAME'];
return true;

BTW, the reason why I try to fix reported bug is that documentation states:

"URI requests are served from the current working directory where PHP was started, unless the -t option is used to specify an explicit document root. If a URI request does not specify a file, then either index.php or index.html in the given directory are returned. If neither file exists, the lookup for index.php and index.html will be continued in the parent directory and so on until one is found or the document root has been reached. If an index.php or index.html is found, it is returned and $_SERVER['PATH_INFO'] is set to the trailing part of the URI. Otherwise a 404 response code is returned."

Which only works if no dot in called URI.

The wording "URI request does not specify a file" is a bit confusing...

[krakjoe]

@remicollet bump, can I ask that you either merge or close this as appropriate please ?

[krakjoe]

Closing because this seems to have gone stale. Feel free to have another shot.