Serving static files when using the built-in webserver.

[renan]

When using built-in webserver static files are not served, instead exceptions are thrown:

2013-09-18 14:43:29 Error: [Cake\Error\MissingControllerException] Controller class Css could not be found.
Exception Attributes: array (
  'class' => 'Css',
  'plugin' => NULL,
  'prefix' => NULL,
)
Request URL: /css/cake.generic.css
Stack Trace:
#0 /Users/renan/Sites/cakephp/3.0-app/webroot/index.php(41): Cake\Routing\Dispatcher->dispatch(Object(Cake\Network\Request), Object(Cake\Network\Response))
#1 {main}
2013-09-18 14:43:29 Error: [Cake\Error\MissingControllerException] Controller class Img could not be found.
Exception Attributes: array (
  'class' => 'Img',
  'plugin' => NULL,
  'prefix' => NULL,
)
Request URL: /img/cake.power.gif
Stack Trace:
#0 /Users/renan/Sites/cakephp/3.0-app/webroot/index.php(41): Cake\Routing\Dispatcher->dispatch(Object(Cake\Network\Request), Object(Cake\Network\Response))
#1 {main}

The current AssetDispatcher only tries to serve themed and plugins' assets.

From PHP's documentation:

If a PHP file is given on the command line when the web server is started it is treated as a "router" script. The script is run at the start of each HTTP request. If this script returns FALSE, then the requested resource is returned as-is. Otherwise the script's output is returned to the browser.

In order to serve the static files from webroot directory it is necessary to return false on the router script and let the webserver serve it.

[markstory]

This doesn't prevent local file inclusion or directory traversal. We should fail to handle any requests that include .. or the %2c in them.

[markstory]

Make that %2e.

[renan]

I thought it would not be a problem since you are not supposed to use it on production, where this kind of attack usually happens.

I ended up doing something similar to what AssetDispatcher does.

[markstory]

Not supposed to, but some uneducated person somewhere will do it. And we'll be the person they blame.

[markstory]

You branch is called 3.0-webserver, but the merge target is master is that intentional?

[dereuromark]

The app folder is also "3.0-app", so most likely the target of the PR was left on default - which is master - by accident.

[renan]

The app repository does not contains a 3.0 branch, yet it is compatible with CakePHP 3.0, hence the branch name. I could have called just webserver-fix. Next time I may create on my fork tho.

[dereuromark]

Doesn't is_file() include file_exists() already?

[renan]

You are right, will fix it up.

[renan]

@markstory You made me wonder. How will be the versioning on this repository? Starting with 3.0 or with its own versioning?

[markstory]

It will start on 3.0 :)

[markstory]

Ignore my previous comments about branches + versions, I'm a tool. I totally didn't notice that this was the cakephp/app repo. Sorry for the confusion.

[renan]

Any more thoughts on this?