• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1088
  • Last Modified:

ForceType with Rewrite

Hi,

I'm trying to set up a dynamic open source site, and I have the following idea:

For any page root:/dir/file.php, going to root:/txt/dir/file.php will show the source code without running it, i.e. a rewrite triggers a ForceType to text/plain.

Individually, I could handle each of these, but I don't know how to do them together.

Don't worry specifically about images etc being affected by the rewrite - users should never try /txt/path/to.jpg and if they do it'll be no benefit to them.
I also hide passwords and intentionally hidden data in .htaccess protected files so I don't think people will be able to steal anything sensitive.

Could you also tell me if this isn't posible, or even should be but you don't know how. That way I can stop wasting time looking for something that can't be achieved and get on with more vital areas.

Thank you,

_Blue
0
eeBlueShadow
Asked:
eeBlueShadow
  • 5
  • 4
  • 2
  • +1
1 Solution
 
crackyCommented:
This can be done.

If you are happy to keep the same files in 2 locations, then this can be done without a Rewrite rule. Since ForceType works on a per-directory or location basis.

Assume you have a directory in your site called /source that holds exact duplicates of the directory structure of your root directory.

You would then place the following in your /source/.htaccess file:

ForceType application/x-httpd-php-source

This would then give you a syntax-highlighted source code for anything in /source/* no matter what the extension.

I'm sure you are aware, but make sure nothing sensitive is placed in this directory.

I tested this same directive with a RewriteRule, but it causes an internal server error if the files are not phisically in the specified ForceType directory. It might work with a little tweaking, but I can't get it to work unless the files are duplicated physically in the /source directory. If I try this in a .htaccess in the root dir:

RewriteEngine on
RewriteRule ^/source/(.*) /$1
<Location /source>
    ForceType application/x-httpd-php-source
</Location>

It fails. Since it is trying to force type for files that are not actually there.

Does this make sense?
0
 
crackyCommented:
I just checked the Apache docs and it turns out that <Location> can only be used in config, not in .htaccess.

So, technically speaking, you should be able to set this at config level without having to copy the files to 2 locations, since the <Location> directive processes the URL, not the file system.

This is just a guess and may or may not work in testing.
0
 
eeBlueShadowAuthor Commented:
I didn't really want to copy files to two locations, I kinda wanted it to be automatic - when I update the code I'd like the source to update as well...

If you can give me more advice on the location method, that'd be much appreciated

_Blue
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
crackyCommented:
I can only see this working if you have access to the httpd.conf file on your server. Is this the case? Are you using a virtual host or a dedicated server?
0
 
eeBlueShadowAuthor Commented:
Yeah, it's ok :)
0
 
crackyCommented:
OK,

The Location directive processes the URL used to access the site, so to add the ForceType on a Location basis, you need to do this in your server's root config section (not .htaccess). Look for it in your httpd.conf file.

<Location /source/*>
    ForceType application/x-httpd-php-source
</Location>

For more info: http://httpd.apache.org/docs/mod/core.html#location

You will also need to apply a RewriteRule in your root Directory:

<Directory "/Your/Document/Root">

    Options Indexes FollowSymLinks MultiViews

    AllowOverride None

    Order allow,deny
    Allow from all

    RewriteEngine on
    RewriteRule ^/source/(.*) /$1

</Directory>

Be aware that the order in which these requests are processed is relevant and Directory directives are evaluated before Location directives. It is for this reason that what I am saying is only theoretical and might break, since your Location directive using ForceType takes effect after the RewriteRule that makes the request for the file.

I don't have time to test it on my server, but hopefully this will get you going in the right direction and give you a grasp of what I am proposing.
0
 
eeBlueShadowAuthor Commented:
Ok, I've had a bit of a fiddle and I still can't see why it isn't working.

The RewriteRule is fine (didn't need the initial / but thats irrelevant)

The ForceType doesn't appear to do anything in a <Location>.

I found out that there is a [T=mime/type] flag for RewriteRule to force a MIME type onto a rewrite, but that also isn't doing anything either.

What could there be which is overriding my ForceType? A ForceType on <Files *> in an .htaccess works, what other in-between stages can I try to find out where the problem is? (I don't know anything about the order rules are processed and can't make much sense of the docs)

Cheers for the help,
_Blue
0
 
MercantilumCommented:
It maybe difficult to get this working through forcetype and rewriterule when you want to access a cgi-bin file.

What I suggest is

/www/cgi-bin/mycgi   being your cgi dir
/www/docs/mydoc     being your documents dir

Simply do as root

   cd /www/docs/mydoc
   ln -s /www/cgi-bin/mycgi source

Ensure you have the
   Options +FollowSymLinks
for the docs directory to allow links following.

Try to access your cgi dir  
    http://www.x.com/source/myscript 
and you get the source of your script.

( in case of error(s), have a look to your /var/log/httpd/error_log )
0
 
ahoffmannCommented:
(didn't follow/test all suggestions so far)

You don't need 2 directories or 2 sites, just a rewrite rule.
Best is you use a cgi script to display your source, this cgi gets the file to be displayed as parameter.
Also don't forget to add [PT] to the rewrite rule.

something like:

   RewriteCond  %{REQUEST_METHOD} ^(GET|POST)$
   RewriteCond  %{QUERY_STRING}  !^SHOW$
   RewriteRule  ^(.+)$           /cgi-bin/show.pl?$1 [PT]

where show.pl is (just an example, to be improved in many ways):
#!/usr/bin/perl
open F,$ENV{QUERY_STRING};print <F>;exit 0;
0
 
MercantilumCommented:
Just a clarification in my solution above (ln -s) there is still only one directory, you just set a link to the php scripts data
0
 
eeBlueShadowAuthor Commented:
ahoffmann, that's a good idea and I don't know why I didn't think of it before. It's definitely worth some points, but I'd like to find out why the other way doesn't work first.

Mercantilum, I don't have a cgi-bin, I thought of of the points of Apache's MIME type system was that you didn't need a separate directory for your executable files. (I saw a page somewhere about this but I can't find it now). Anyhow, my PHP files are intermingled with my HTMLs and my JPGs and I'd like to keep the directory structure as it is now.

Like I say, the biggest clue I have now is that the

RewriteRule ^/source/(.*) /$1 [T=application/x-httpd-php-source]

does the rewrite, but the type change doesn't work. I do get the following line in my rewrite.log though:

remember [...] to have MIME-type 'application/x-httpd-php-source'

and I don't know whats stopping it.

Thanks for your help so far,
_Blue
0
 
ahoffmannCommented:
short time ago I also struggled with [T=blablabla], and came up with [PT], nothing else worked
can't say that it's a bug or alike, just didn't dig deeper 'cause [PT] did what I nedded :-|
0
 
eeBlueShadowAuthor Commented:
I couldn't find any way to get the Apache config working, seems it's an IE problem - IE tries to be too greedy.

The script solution worked, but it isn't perfect as it doesn't like URLs that don't match the local directory structure.

Thanks,
_Blue
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 5
  • 4
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now