set cgi.fix_pathinfo=0 in php.ini