Skip to content

Commit 8d79b4d

Browse files
committed
check if the file exists, return 404 otherwise (Jerome Loyet)
1 parent 75ec779 commit 8d79b4d

File tree

1 file changed

+25
-17
lines changed

1 file changed

+25
-17
lines changed

sapi/fpm/fpm/fpm_main.c

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1776,24 +1776,32 @@ consult the installation file that came with this distribution, or visit \n\
17761776
return FAILURE;
17771777
}
17781778

1779-
if (SG(request_info).path_translated) {
1780-
if (php_fopen_primary_script(&file_handle TSRMLS_CC) == FAILURE) {
1781-
zend_try {
1782-
if (errno == EACCES) {
1783-
SG(sapi_headers).http_response_code = 403;
1784-
PUTS("Access denied.\n");
1785-
} else {
1786-
SG(sapi_headers).http_response_code = 404;
1787-
PUTS("No input file specified.\n");
1788-
}
1789-
} zend_catch {
1790-
} zend_end_try();
1791-
/* we want to serve more requests if this is fastcgi
1792-
* so cleanup and continue, request shutdown is
1793-
* handled later */
1779+
/* If path_translated is NULL, terminate here with a 404 */
1780+
if (!SG(request_info).path_translated) {
1781+
zend_try {
1782+
SG(sapi_headers).http_response_code = 404;
1783+
} zend_catch {
1784+
} zend_end_try();
1785+
goto fastcgi_request_done;
1786+
}
17941787

1795-
goto fastcgi_request_done;
1796-
}
1788+
/* path_translated exists, we can continue ! */
1789+
if (php_fopen_primary_script(&file_handle TSRMLS_CC) == FAILURE) {
1790+
zend_try {
1791+
if (errno == EACCES) {
1792+
SG(sapi_headers).http_response_code = 403;
1793+
PUTS("Access denied.\n");
1794+
} else {
1795+
SG(sapi_headers).http_response_code = 404;
1796+
PUTS("No input file specified.\n");
1797+
}
1798+
} zend_catch {
1799+
} zend_end_try();
1800+
/* we want to serve more requests if this is fastcgi
1801+
* so cleanup and continue, request shutdown is
1802+
* handled later */
1803+
1804+
goto fastcgi_request_done;
17971805
}
17981806

17991807
fpm_request_executing();

0 commit comments

Comments
 (0)