6.0.0-alpha14
7/1/25

[#11759] Don't use $_SERVER["REDIRECT_URL"]
Summary Don't use $_SERVER["REDIRECT_URL"]
Queue Horde Framework Packages
Queue Version Git master
Type Bug
State Not A Bug
Priority 1. Low
Owners
Requester manuel-horde (at) mausz (dot) at
Created 11/26/2012 (4600 days ago)
Due
Updated 03/21/2014 (4120 days ago)
Assigned 02/11/2014 (4158 days ago)
Resolved 03/21/2014 (4120 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch No

History
03/21/2014 12:17:39 PM Jan Schneider State ⇒ Not A Bug
 
02/12/2014 10:31:57 PM arjen+horde (at) de-korte (dot) org Comment #9 Reply to this comment
That is interesting. Can you run the tests mentioned in the first 
comment of this bug? Would be good to see what the 2.4 behaviour is.
Not surprisingly (since nag works fine here), it returns the same as 
with mod_php:

_SERVER["REQUEST_URI"]   => "/does/not/matter"
_SERVER["REDIRECT_URL"] => "/does/not/matter"
02/11/2014 01:37:23 PM horde (at) stefanseidel (dot) info Comment #8 Reply to this comment
Interesting. I'm using apache2.4 + mod_proxy_fcgi + PHP_FPM and with 
that combination there is no problem saving a task in nag. So the 
test case may not be so simple after all.
That is interesting. Can you run the tests mentioned in the first 
comment of this bug? Would be good to see what the 2.4 behaviour is.

Anyway, Apache 2.2 is still the default for the latest CentOS and 
Debian releases, so I believe it's worth making this change which will 
so far only break some special setups which are not standard.
02/11/2014 11:12:11 AM arjen+horde (at) de-korte (dot) org Comment #7 Reply to this comment
REDIRECT_URL must be used if using Apache redirects though. See
https://github.com/horde/horde/commit/a9b1cbd21e99e2483ea3a088380b89fb775dfc4c
When would that happen? As stated, REDIRECT_URL will return the 
redirected URL, e.g. rampage.php, but not the requested URL, for 
example /nag/t/save. There's a "simple" test case: install horde on 
apache2+mod_fastcgi or php-fpm, try to create/save a task in nag. It 
will produce an error.
Interesting. I'm using apache2.4 + mod_proxy_fcgi + PHP_FPM and with 
that combination there is no problem saving a task in nag. So the test 
case may not be so simple after all.
02/11/2014 11:11:26 AM horde (at) stefanseidel (dot) info Comment #6 Reply to this comment
Internal redirects isn't anything we use inside Horde, but it may 
well be used in the user's Apache configuration. I don't recall the 
exact use case anymore, but it may have occurred when moving 
services around during our web server redesigns, to keep old URLs 
intact.
So the question is whether this is a better use case than the ones I 
mentioned, namely using Horde in various "normal" environments that 
just happen to be not Apache+mod_php.
02/11/2014 11:06:12 AM Jan Schneider Comment #5 Reply to this comment
Internal redirects isn't anything we use inside Horde, but it may well 
be used in the user's Apache configuration. I don't recall the exact 
use case anymore, but it may have occurred when moving services around 
during our web server redesigns, to keep old URLs intact.
02/11/2014 10:57:15 AM horde (at) stefanseidel (dot) info Comment #4 Reply to this comment
REDIRECT_URL must be used if using Apache redirects though. See 
https://github.com/horde/horde/commit/a9b1cbd21e99e2483ea3a088380b89fb775dfc4c
When would that happen? As stated, REDIRECT_URL will return the 
redirected URL, e.g. rampage.php, but not the requested URL, for 
example /nag/t/save. There's a "simple" test case: install horde on 
apache2+mod_fastcgi or php-fpm, try to create/save a task in nag. It 
will produce an error.

The single commit you referenced does not state any use cases, but it 
would be good to know _what_  would break in this case. I haven't 
noticed anything yet, and I've tested imp, kronolith, nag, ansel 
(including slugs & password), wicked, mnemo, activesync, 
caldav+carddav and gollem (most of them with and without URL 
rewriting) with the change and none of them had a problem.
02/11/2014 10:45:56 AM Jan Schneider Comment #3
State ⇒ Feedback
Reply to this comment
REDIRECT_URL must be used if using Apache redirects though. See 
https://github.com/horde/horde/commit/a9b1cbd21e99e2483ea3a088380b89fb775dfc4c
12/03/2013 07:31:50 AM horde (at) stefanseidel (dot) info Comment #2 Reply to this comment
Thanks, it took me a whole day to figure out the problem with my 
PHP-FPM installation of Horde (and I only found this bug _after_ I 
knew what the problem was). I think it should be tested with nginx 
also, but from what I read on other bugtrackers[1][2] it's net even 
present on nginx.

[1] https://github.com/photo/frontend/pull/1134
[2] https://drupal.org/node/1424678
11/26/2012 08:24:59 PM manuel-horde (at) mausz (dot) at Comment #1
Priority ⇒ 1. Low
Type ⇒ Bug
Summary ⇒ Don't use $_SERVER["REDIRECT_URL"]
Queue ⇒ Horde Framework Packages
Milestone ⇒
Patch ⇒ No
State ⇒ Unconfirmed
Reply to this comment
Relying on $_SERVER["REDIRECT_URL"] (before $_SERVER["REQUEST_URI"]) 
for a valid URL causes problems when using php-fastcgi or php-fpm. 
e.g. rampage won't work in these setups.

A simple test using apache 2.2 + mod_rewrite yields the following results:
Setup:
* .htaccess File inside docroot with content: RewriteRule ^(.*)$ 
test.php [QSA,L]
* GET-URL: http://something/does/not/matter

test.php served using mod_php:
_SERVER["REQUEST_URI"]   => "/does/not/matter"
_SERVER["REDIRECT_URL"] => "/does/not/matter"

test.php served using php-fastcgi (mod_fastcgi):
_SERVER["REQUEST_URI"]   => "/does/not/matter"
_SERVER["REDIRECT_URL"] => "/test.php"

test.php served using php-fpm (+mod_fastcgi):
_SERVER["REQUEST_URI"]   => "/does/not/matter"
_SERVER["REDIRECT_URL"] => "/test.php"

Classes using REDIRECT_URL before REQUEST_URI:
* Horde_Core_Factory_Request
* Horde_Controller_Request_Mock

Saved Queries