Last modified: 2011-09-21 15:02:15 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T23587, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 21587 - Multiple calls from index.php with action=raw results in 403 Forbidden
Multiple calls from index.php with action=raw results in 403 Forbidden
Status: NEW
Product: MediaWiki
Classification: Unclassified
General/Unknown (Other open bugs)
1.15.x
Other Linux
: Low normal with 2 votes (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-11-21 22:45 UTC by Szymon Łukaszczyk
Modified: 2011-09-21 15:02 UTC (History)
6 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Szymon Łukaszczyk 2009-11-21 22:45:58 UTC
After clean wikimedia install all sites calls during loading:
/index.php?title=MediaWiki:Common.css&usemsgcache=yes&ctype=text%2Fcss&smaxage=18000&action=raw&maxage=18000
/index.php?title=MediaWiki:Print.css&usemsgcache=yes&ctype=text%2Fcss&smaxage=18000&action=raw&maxage=18000
/index.php?title=MediaWiki:Monobook.css&usemsgcache=yes&ctype=text%2Fcss&smaxage=18000&action=raw&maxage=18000
/index.php?title=-&action=raw&maxage=18000&smaxage=0&ts=20091121231526&gen=css
/index.php?title=-&action=raw&smaxage=0&gen=js&useskin=monobook
/index.php?title=-&action=raw&smaxage=0&gen=js&useskin=monobook

Each called site results in 403 Forbidden and html:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>Forbidden</title></head><body><h1>Forbidden</h1><p>Raw pages must be accessed through the primary script entry point.</p></body></html>

Server configuration:
os: debian unstable
http server:  ngingx/0.7.63
php: PHP Version 5.2.11-1
fcgi-server: spawn-fcgi 1.6.3-1

No logs in nginx/error.log during site loading.
Comment 1 Druker 2010-03-20 17:04:02 UTC
The same issue was found in my personal wiki. I just noticed this issue when I was trying to use common.js to customize the sidebar. I did not see common.js was included in the html page.

My Configuration is:
Server: Cherokee Web Server 0.99.43 with URL rewriting
PHP 5.2.10-2ubuntu6.4 with Suhosin-Patch 0.9.7 (cgi-fcgi) (built: Jan  6 2010 22:34:28)
Comment 2 Druker 2010-03-20 17:08:27 UTC
Forget to write down my mediawiki version: 1.15.0
I tried the fix as described in http://www.mediawiki.org/wiki/Special:Code/MediaWiki/49833. It does not fix this issue.
Comment 3 Mike McGurrin 2010-12-05 16:54:21 UTC
I get what I think is an aspect of the same problem on Wikipedia for some queries.  For example, http://en.wikipedia.org/wiki/Washington,_d.c. gives me a redirection page, but http://en.wikipedia.org/wiki/Washington,_d.c.?action=raw yield:

Forbidden

Invalid file extension found in PATH_INFO. Raw pages must be accessed through the primary script entry point.
Comment 4 Bawolff (Brian Wolff) 2010-12-05 21:59:05 UTC
(In reply to comment #3)
> I get what I think is an aspect of the same problem on Wikipedia for some
> queries.  For example, http://en.wikipedia.org/wiki/Washington,_d.c. gives me a
> redirection page, but http://en.wikipedia.org/wiki/Washington,_d.c.?action=raw
> yield:
> 
> Forbidden
> 
> Invalid file extension found in PATH_INFO. Raw pages must be accessed through
> the primary script entry point.

Thats desired behaviour to stop IE3 from being stupid and trying to execute the page as js. action=raw is only supposed to work if you access it through index.php like http://en.wikipedia.org/w/index.php?title=Washington,_d.c.&action=raw (The original poster have a different issue since they're accessing the pages through index.php.)
Comment 5 Brion Vibber 2011-05-27 21:37:21 UTC
Bug 28840 seems to be the same issues though specifically mentioning ResourceLoader initially. The checks similarly break action=raw for titles containing periods, such as we use for all JS/CSS pages not loaded via RL. (Not the traditional check that actually does make you use the index.php point, but the new extension checks on the query string are the problem here.)

Possibly this should just be marked dupe? Adding a dep for now.
Comment 6 Bawolff (Brian Wolff) 2011-05-27 21:42:04 UTC
(In reply to comment #5)
> Bug 28840 seems to be the same issues though specifically mentioning
> ResourceLoader initially. The checks similarly break action=raw for titles
> containing periods, such as we use for all JS/CSS pages not loaded via RL. (Not
> the traditional check that actually does make you use the index.php point, but
> the new extension checks on the query string are the problem here.)
> 
> Possibly this should just be marked dupe? Adding a dep for now.

I think they are different unrelated issues. This one is about the check thats been there forever, where the other one is about the check just recently introduced.
Comment 7 Brion Vibber 2011-05-27 21:44:59 UTC
Ah true, that's on the older version. Restoring.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links