Maniphest T100821

Problem with ./images/.htaccess (images and thumbnails disappear) - solution is to comment out "Options +FollowSymLinks"
Open, LowPublic
Actions

Assigned To

None

Authored By

	LoopZilla
	May 29 2015, 6:33 PM

Project Tags

Referenced Files

None

Subscribers

Description

I have had to remove (comment out)

Options +FollowSymLinks

in ./images/.htaccess

I noticed that images in 1.24.2 and migration to 1.25.1 were not being displayed. I could see....

"Error creating thumbnail: File missing"

PHP 5.4.39-0+deb7u2 (cgi-fcgi)
MariaDB 10.0.19-MariaDB-1~wheezy
Apache 2

Related Objects

Mentioned Here: T64289: images .htaccess file makes images inaccessible

Event Timeline

LoopZilla created this task.May 29 2015, 6:33 PM

LoopZilla claimed this task.

LoopZilla raised the priority of this task from to Low.

LoopZilla updated the task description. (Show Details)

LoopZilla subscribed.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 29 2015, 6:33 PM

This is a fix for bug T64289

greg added a project: MediaWiki-General.May 29 2015, 6:42 PM

greg set Security to None.

In T100821#1321538, @LoopZilla wrote:

This is a fix for bug T64289

Sorry but I don't understand. What exactly is the fix? T64289 is closed as fixed.

Also, please edit the task summary to describe the actual "Problem with ./images/.htaccess".

In my current installation I have this.

Fix for bug T64289
Options +FollowSymLinks

If I change to this "Options +FollowSymLinks" then thumbnails and images disappear from the wiki. In other words, I suggesting the fix for bug T64289 needs to be reversed.

LoopZilla renamed this task from Problem with ./images/.htaccess to Problem with ./images/.htaccess (images and thumbnails disappear) - solution is to comment out "Options +FollowSymLinks" .May 31 2015, 5:43 PM

This seems to work:

Fix for bug T64289
Options +FollowSymLinks Options +SymLinksIfOwnerMatch

It seems that the HASH (comment) symbol does not appear!

I have commented out

Options +FollowSymLinks

and added

Options +SymLinksIfOwnerMatch

This was suggested on the mailing list.

This was suggested on the mailing list.

Which mailing list? Link welcome.

https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Subject: MediaWiki 1.25.1 - lost images.

First message - 29th May 2015.

apache error log: [[DocumentRoot]]/w/images/.htaccess: Options not allowed here

If I add anything to .htaccess, it will fail and images disappear.

System is RHEL6.6/Santiago, Apache 2.2.15 release 39.el6

/etc/httpd/sites-enabled/[[site]].conf:
    <Directory /var/www/home/[[site]]>
        Options SymLinksIfOwnerMatch
        AllowOverride AuthConfig Indexes Limit FileInfo
        Order Deny,Allow
        Allow from all
        AddHandler php5-script .php .php3 .php4 .php5
        Action php5-script /vhost.bin/php
    </Directory>
</VirtualHost>

DanielFriesen subscribed.Sep 4 2015, 6:19 AM

Szotsaki subscribed.Mar 24 2016, 5:58 PM

Options +FollowSymLinks is bad when mediawiki runs under apache in a shared environment. Usually then users are not allowed to set +FollowSymLinks, and this config option will cause a Server Error 500, when set in .htaccess.

So do not break all access to images in a shared environment by default!

Even "Options +SymLinksIfOwnerMatch" may not be allowed in .htaccess for security reasons.

Aklapper removed LoopZilla as the assignee of this task.Sep 15 2019, 5:28 PM