nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-03-13 08:00:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'fix_issue_53' into 'master'

Browse Source 
Removed favicon.ico work around (fix #53, Debian bug #703294)

This relates to debian bug report #703294 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703294>; of Chris Mitterer. He makes the case to delete a block at the very beginning of the file caldav.php.

Andrew authored that code block once (6 years ago?) with the following commit message:

> Provide passthru on icons, images, css and js files.
> In Chrome it requests the favicon (for example) very frequently
> which was causing a prompt for authentication where there was a
> poorly considered regex in the rewrite rules.  I think this is
> a good backup to the rewrite rules to pass through on such files.

As far as i unterstand the code it does in fact passthrough requests for favicon.ico. But these should not happen at all anyway (but seem to have happened with a specific browser and a malformed rewrite rule). And I agree with Chris: most of the code does not work as intended and is potentially introducing security holes.
 
So after having a closer look on this I vote to follow the recommendation of Chris to DELETE this block and close the bug.

See merge request !20
This commit is contained in:
Paul Kallnbach 2015-12-10 20:22:31 +00:00
commit 71a2d247e1
1 changed files with 1 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
htdocs/caldav.php
View File

@ -8,17 +8,7 @@
* @copyright Catalyst .Net Ltd, Morphoss Ltd <http://www.morphoss.com/>
* @license http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
*/
if ( isset($_SERVER['PATH_INFO']) && preg_match( '{^(/favicon.ico|davical.css|(images|js|css)/.+)$}', $_SERVER['PATH_INFO'], $matches ) ) {
$filename = $_SERVER['DOCUMENT_ROOT'] . preg_replace('{(\.\.|\\\\)}', '', $matches[1]);
$fh = @fopen($matches[1],'r');
if ( ! $fh ) {
@header( sprintf("HTTP/1.1 %d %s", 404, 'Not found') );
}
else {
fpassthru($fh);
}
@ob_flush(); exit(0);
}
require_once('./always.php');
if ( isset($_SERVER['PATH_INFO']) && preg_match( '{^/\.well-known/(.+)$}', $_SERVER['PATH_INFO'], $matches ) ) {