Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mod_mirrorbrain does not handle filename correctly if inside of symlinked dir #173

Open
sme-gmbh opened this issue Dec 22, 2017 · 2 comments

Comments

@sme-gmbh
Copy link

Let's assume we have the following standard httpd setup with mirrorbrain activated:
DocumentRoot /var/www/htdocs/
FollowSymlinks yes

Inside of that directory we place a symlink pointing to a directory with longer path:
/var/www/htdocs/mysymlink -> /mnt/www/somelongdir/someotherdir/

We place file "foo.txt" in that folder and try to wget that from the webserver.

The following will happen:
mod_mirrorbrain tries to strip the DocumentRoot part of the filename.
But it does not strip "/mnt/storage/somedir/someotherdir/" as it should do, it strips the number of char according to the length of "/var/www/htdocs/".

This results in an invalid lookup path, giving a strange error log:

[Fri Dec 22 14:21:54.376008 2017] [mirrorbrain:notice] [pid 6000:tid 140026726733568] [client xx.xx.xx.xx:34122] [mod_mirrorbrain] 'ngdir/someotherdir/mysymlink/foo.txt': no usable mirrors after classification. Have to deliver directly.

The problem ist here in mod_mirrorbrain.c:
/* the leading directory needs to be stripped from the file path /
/
a directory from Apache always ends in '/'; a result from realpath() doesn't */
filename = realfile + strlen(mirror_base) + 1;

This does not care about symlinks.

@sme-gmbh
Copy link
Author

This works at least for me:
https://github.com/sme-gmbh/mirrorbrain/tree/url-source-rework

@darix
Copy link

darix commented Mar 24, 2020

JFYI: If you dont object, I will pull this fix into gh:openSUSE/mirrorbrain. (which is our fork with all the fixes and features we did over the last few years)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants