contao/test — Issue #1579: Rewrite rule to just "index.php" can cause content disclosure when used with mod_cache
Author: importer
Created: 2011-11-29 08:10:54+00:00
State: open
Labels: Feature, frontend

When using mod_cache to boost typolight performance in apache (using header controlled http caching), you experience content collisions and content disclosure situations due to the nature how mod_cache works (this can also become a security problem).

The problem is that typolights mod_rewrite configuration rewrites all urls to index.php which is the final url that mod_cache sees. So every and each page in typolight has the same url seen from mod_caches perspective.

It's easy to fix this by changing the mod_rewrite rule to the following:

RewriteRule (.*\.html)$ index.php/$1 [L]

This creates unique urls for mod_cache for every page. I suppose this needs pathinfo to be enabled in apache so it still recognized index.php as the script file to execute.

Related issues: #1787

--- _Originally created by hurikhan77 on February 18th, 2010, at 11:49am (ID 1579)_