We have what is supposed to be a pretty standard setup of Apache+php-fpm, but when an URL includes path info after the script name something strange happens -- it treats the path info as a script name relative to the web root. Like this:
# cat foo.php
<?php print 'I am foo! PATH_INFO = "' . $_SERVER['PATH_INFO'] . '"; SCRIPT_NAME = "' . $_SERVER['SCRIPT_NAME'] . '"; PHP_SELF = "' . $_SERVER['PHP_SELF'] . '"' ?>
# cat bar.php
<?php print 'I am bar! PATH_INFO = "' . $_SERVER['PATH_INFO'] . '"; SCRIPT_NAME = "' . $_SERVER['SCRIPT_NAME'] . '"; PHP_SELF = "' . $_SERVER['PHP_SELF'] . '"' ?>
# curl -kw\\n https://localhost/xxx/foo.php
I am foo! PATH_INFO = ""; SCRIPT_NAME = "/xxx/foo.php"; PHP_SELF = "/xxx/foo.php"
# curl -kw\\n https://localhost/xxx/bar.php
I am bar! PATH_INFO = ""; SCRIPT_NAME = "/xxx/bar.php"; PHP_SELF = "/xxx/bar.php"
# curl -kw\\n https://localhost/xxx/foo.php/xxx/bar.php
I am bar! PATH_INFO = "/xxx/bar.php"; SCRIPT_NAME = "/xxx/foo.php"; PHP_SELF = "/xxx/bar.php"
I was expecting the last one to give something like (correct me if I'm wrong):
I am foo! PATH_INFO = "/xxx/bar.php"; SCRIPT_NAME = "/xxx/foo.php"; PHP_SELF = "/xxx/foo.php/xxx/bar.php"
We have the following in /etc/httpd/conf.d/php-fpm.conf:
<IfModule proxy_fcgi_module>
# Enable http authorization headers
<IfModule setenvif_module>
SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
</IfModule>
<FilesMatch ".+\.ph(p[3457]?|t|tml)$">
SetHandler "proxy:fcgi://localhost:9000"
</FilesMatch>
<FilesMatch ".+\.phps$">
# Deny access to raw php sources by default
# To re-enable it's recommended to enable access to the files
# only in specific virtual host or directory
Require all denied
</FilesMatch>
# Deny access to files without filename (e.g. '.php')
<FilesMatch "^\.ph(p[3457]?|t|tml|ps)$">
Require all denied
</FilesMatch>
</IfModule>
Apache version 2.4.6 and php71-php-fpm-7.1.33. We have an application that expects the 'normal' behaviour, how can we get it with php-fpm?