Tags:
create new tag
, view all tags

Question

I may be wrong but...

I have followed the instructions for secirig TWiki attachments & have a simple rewrite rule:

Options +FollowSymLinks 

RewriteEngine on
RewriteCond %{REQUEST_URI} !^/pub/TWiki/+.+
RewriteRule ^([^/]+)/+((([^/]+)/+)+)(.+) /cgi-bin/viewfile/$1/$4?filename=$5 [L,PT] 

This works, but I have noticed that inline images aren't rendered in sub-webs. I thought I had the rewrite wrong, but then I was using ImageGalleryPlugin & it wasn't rendering. In debugging I typed

/cgi-bin/viewfile/topweb/topic/_ig1?filename=image1.gif

and viewfile reports the "topweb/topic" web does not exist. I can type

/cgi-bin/viewfile/Sales/BrandLogos?filename=logo1.gif

but if I create a further sub-directory test, then:

/cgi-bin/viewfile/Sales/BrandLogos/test?filename=logo1.gif

reports the Sales/BrandLogos web does not exist.

It would seem viewfile is confused by any structure other than "web/topic"

Environment

TWiki version: TWikiRelease04x01x01
TWiki plugins: DefaultPlugin, EmptyPlugin, InterwikiPlugin
Server OS: Gentoo
Web server: Apache 2
Perl version: 5.8
Client OS: Windows XP
Web Browser: Firefox
Categories: Security

-- ChrisHogan - 20 Jun 2007

Answer

ALERT! If you answer a question - or have a question you asked answered by someone - please remember to edit the page and set the status to answered. The status is in a drop-down list below the edit box.

I was partly wrong - it's not the viewfile, but the rewrite rules:

RewriteRule ^([^/]+)/+((([^/]+)/+)+)(.+) /cgi-bin/viewfile/$1/$4?filename=$5 [L,PT] 

$1 gives the top level web, $4 the topic name & $5 the file name, but if there is a sub web: /Sales/Client/SomeTopic/filename.gif the sub web "Client is left out by this rule.

I still guess that viewfile is expecting /Sales/BrandLogos/test?filename=logo1.gif to mean test is the topic, not a subdirectory, so the Image Gallery won't work through viewfile.

Two problems not one then.

-- ChrisHogan - 25 Jun 2007

Sorry, closing this after more than 30 days of inactivity...

-- PeterThoeny - 10 Aug 2007

I've fixed this problem by changing the rewrite rule as follows:

RewriteRule ^/+twiki/+pub((/+[^/]+)+)/+(.+) /twiki/bin/viewfile$1?filename=$3 [L,PT]

(Remove the leading /+twiki if your site is in the root, change bin to cgi-bin if required.).

It looks to me like the original RewriteRule tried to include support for hierarchy, but it was over-complicated. This version is simpler and seems to work fine for both single-level and hierarchical webs.

-- BenWheeler - 25 Sep 2007

This is what works for me, even simpler: RewriteRule ^/+twiki/+pub/+(.+)/+([^/]+)$ /twiki/bin/viewfile/$1?filename=$2 [L,PT]

Note that I don't think this actually restricts access to attachements according to the permissions. I'm opening a bug on it.

-- WoutMertens - 09 Oct 2007

Hmmm, looks like the access permissions are handled by the Store.pm module. This is unlike the view() command, which handles access permissions itself. Very odd.

-- WoutMertens - 09 Oct 2007

 
Change status to:
Topic revision: r5 - 2007-10-09 - WoutMertens
 
Twitter Delicious Facebook Digg Google Bookmarks E-mail LinkedIn Reddit StumbleUpon    
  • Download TWiki
TWiki logo Powered by Perl Hosted by OICcam.com Ideas, requests, problems regarding TWiki? Send feedback. Ask community in the support forum.
Copyright © 1999-2012 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.