Timeline for Protect Upload Folder Files With Ampersand Problem
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 31, 2021 at 2:34 | vote | accept | crmau | ||
| Jan 29, 2021 at 18:43 | answer | added | MrWhite | timeline score: 2 | |
| Jan 29, 2021 at 18:30 | history | edited | MrWhite | CC BY-SA 4.0 |
Formatting
|
| Jan 29, 2021 at 15:22 | comment | added | crmau | With checkloggedin.php?file=$1 [QSA,L] in the htaccess when accessing a file that has an ampersand in the filename then PHP Warning: mime_content_type() failed to open stream: No such file or directory is displayed. If I change to checkloggedin.php?file=$1 [BNC] in the htaccess there is now no problem accessing a file that has an ampersand in the filename but then checkloggedin.php does not get hit so it does not check if the user is logged in before accessing the file. | |
| Jan 29, 2021 at 15:20 | comment | added | crmau | Thanks for your help, sorry if I was not clear. Yes, if the filename requested contains an ampersand there is a problem. URL/testfile.pdf (works if the filename does not contain %26 or &) URL/test%26file.pdf (does not work if the filename contains %26 or &) URL/test&file.pdf (does not work if the filename contains %26 or &) | |
| Jan 29, 2021 at 14:10 | comment | added | Celso Bessa | Before going any further. I am presuming you meant the filename requested has an ampersand in the name, am I right? This could be a case of mismatching encoding, perhaps in the checkloggedin.php. Can you give example of a requested filename with ampersand and its correspondent name on your file system? | |
| Jan 29, 2021 at 13:47 | comment | added | kero | By "file contains ampersand" do you mean the filename or the actual file contents? Does this help you to get unknown query params? | |
| Jan 29, 2021 at 13:45 | history | edited | kero | CC BY-SA 4.0 |
improve formatting, remove thanks
|
| Jan 29, 2021 at 13:17 | review | First posts | |||
| Jan 29, 2021 at 15:19 | |||||
| Jan 29, 2021 at 13:16 | history | asked | crmau | CC BY-SA 4.0 |