Page MenuHomePhabricator

Investigate restricting match pattern on /wiki RewriteRule
Open, LowPublic

Description

While adding some redirect tests for T357436 (https://gerrit.wikimedia.org/r/c/operations/puppet/+/1003525), I came across some mildly surprising redirect behavior involving paths prefixed with /wiki.

In short:

This seems to result from a combination of:

  1. the RewriteRule at https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/1dfae2f64dce3d769798110d2ccfbf80af6111e0/modules/mediawiki/templates/apache/mediawiki-vhost.conf.erb#51 matching /wikiblah and
  2. donatewiki's /w/index.php itself serving the redirect

It's #1 that's the surprising part.

Chatting with @RLazarus a bit, it seems like the intention was probably for this to match something a bit more restrictive (e.g., matching ^/wiki(/.*)?$).

The purpose of this task is to investigate whether that was indeed the intent and if so, whether it is safe to restrict the match pattern.

Related Objects

Event Timeline

the intention was probably for this to match something a bit more restrictive (e.g., matching ^/wiki(/.*)?$)

I'm looking at the diff where the RewriteRule was introduced, and I'm pretty sure this is right -- it's replacing a

ProxyPass       /wiki                fcgi://127.0.0.1:9000<%= @docroot %>/w/index.php retry=0

so we went from a path argument to a regex. But some history from @Joe would help to confirm. And we'd still need to make sure nothing else has started relying on this in the last five years.

the intention was probably for this to match something a bit more restrictive (e.g., matching ^/wiki(/.*)?$)

I'm looking at the diff where the RewriteRule was introduced, and I'm pretty sure this is right -- it's replacing a

ProxyPass       /wiki                fcgi://127.0.0.1:9000<%= @docroot %>/w/index.php retry=0

so we went from a path argument to a regex. But some history from @Joe would help to confirm. And we'd still need to make sure nothing else has started relying on this in the last five years.

If you go back further in history, you'll find we used to use an Alias directive, which of course behaves slightly differently too.

As for your question: I don't think anything relies on this, or if something does, we should be ok breaking it.

Change 1007026 had a related patch set uploaded (by RLazarus; author: RLazarus):

[operations/puppet@production] mediawiki: Restrict /wiki RewriteRule

https://gerrit.wikimedia.org/r/1007026