Tags:
create new tag
view all tags

Question

I may be wrong but...

I have followed the instructions for secirig TWiki attachments & have a simple rewrite rule:

Options +FollowSymLinks 

RewriteEngine on
RewriteCond %{REQUEST_URI} !^/pub/TWiki/+.+
RewriteRule ^([^/]+)/+((([^/]+)/+)+)(.+) /cgi-bin/viewfile/$1/$4?filename=$5 [L,PT] 

This works, but I have noticed that inline images aren't rendered in sub-webs. I thought I had the rewrite wrong, but then I was using ImageGalleryPlugin & it wasn't rendering. In debugging I typed

/cgi-bin/viewfile/topweb/topic/_ig1?filename=image1.gif

and viewfile reports the "topweb/topic" web does not exist. I can type

/cgi-bin/viewfile/Sales/BrandLogos?filename=logo1.gif

but if I create a further sub-directory test, then:

/cgi-bin/viewfile/Sales/BrandLogos/test?filename=logo1.gif

reports the Sales/BrandLogos web does not exist.

It would seem viewfile is confused by any structure other than "web/topic"

Environment

TWiki version: TWikiRelease04x01x01
TWiki plugins: DefaultPlugin, EmptyPlugin, InterwikiPlugin
Server OS: Gentoo
Web server: Apache 2
Perl version: 5.8
Client OS: Windows XP
Web Browser: Firefox
Categories: Security

-- ChrisHogan - 20 Jun 2007

Answer

ALERT! If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

I was partly wrong - it's not the viewfile, but the rewrite rules:

RewriteRule ^([^/]+)/+((([^/]+)/+)+)(.+) /cgi-bin/viewfile/$1/$4?filename=$5 [L,PT] 

$1 gives the top level web, $4 the topic name & $5 the file name, but if there is a sub web: /Sales/Client/SomeTopic/filename.gif the sub web "Client is left out by this rule.

I still guess that viewfile is expecting /Sales/BrandLogos/test?filename=logo1.gif to mean test is the topic, not a subdirectory, so the Image Gallery won't work through viewfile.

Two problems not one then.

-- ChrisHogan - 25 Jun 2007

Sorry, closing this after more than 30 days of inactivity...

-- PeterThoeny - 10 Aug 2007

I've fixed this problem by changing the rewrite rule as follows:

RewriteRule ^/+twiki/+pub((/+[^/]+)+)/+(.+) /twiki/bin/viewfile$1?filename=$3 [L,PT]

(Remove the leading /+twiki if your site is in the root, change bin to cgi-bin if required.).

It looks to me like the original RewriteRule tried to include support for hierarchy, but it was over-complicated. This version is simpler and seems to work fine for both single-level and hierarchical webs.

-- BenWheeler - 25 Sep 2007

This is what works for me, even simpler: RewriteRule ^/+twiki/+pub/+(.+)/+([^/]+)$ /twiki/bin/viewfile/$1?filename=$2 [L,PT]

Note that I don't think this actually restricts access to attachements according to the permissions. I'm opening a bug on it.

-- WoutMertens - 09 Oct 2007

Hmmm, looks like the access permissions are handled by the Store.pm module. This is unlike the view() command, which handles access permissions itself. Very odd.

-- WoutMertens - 09 Oct 2007

Change status to:
Edit | Attach | Watch | Print version | History: r5 < r4 < r3 < r2 < r1 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r5 - 2007-10-09 - WoutMertens
 
  • Learn about TWiki  
  • Download TWiki
This site is powered by the TWiki collaboration platform Powered by Perl Hosted by OICcam.com Ideas, requests, problems regarding TWiki? Send feedback. Ask community in the support forum.
Copyright © 1999-2026 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.