here’s the problem: when requesting url like – http://server/path/to/file.html?param=../../something/something i get response:
500 Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
...
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
log says:
xxx.xxx.xxx.xxx - - [05/Mar/2010:13:43:29 -0500] "GET /path/to/file.html?param=../../something/something HTTP/1.1" 404 - "-" ...
if i remove one instance of ‘../’ in query string (request http://server/path/to/file.html?param=../something/something ), i get the reqested page. it gives error only on two or more ‘../’s.
this is on some hosting server, and the same thing gives no error on my local servers (LAMP, WAMP). i suppose it’s about apache configuration, but i don’t know what options to check.
Apache2.2.14 (Unix) is in question, PHP is installed (but it clearly doesn’t have anything to do with PHP when i’m requesting plain ol’ HTML file), mod_rewrite rules are disabled (no .htaccess files in requested file’s path).
any ideas on how to succeed passing multiple ‘../’s in query string?
turned out to be security precaution enabled by default by hosting provider – not allowing ‘backpaths’, but i’m not sure which one, and where it’s set.