Double homepage because of __home__

[Wiejeben]

Description

We noticed that __home__ was being indexed on a website of ours. After looking into it it turned out that the __home__ URI both exists as http://example.com/ and http://example.com/__home__ and is returning a 200 response.

It also works on craftcms.com:

> curl -I https://craftcms.com/__home__
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Wed, 17 Feb 2021 10:39:40 GMT
Link: <https://craftcms.com>; rel='canonical'
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: all
Connection: keep-alive

Steps to reproduce

1. Create a single with the homepage checkbox enabled
2. Browse to/__home__ and you should see that the homepage exists twice

Additional info

So far I have been able to recreate this on multiple 3.x versions.

• Craft version: 3.6.6
• PHP version: 7.3.27
• Database driver & version: 7.4.14

[brandonkelly]

Thanks for reporting that. Just fixed for the next release.

[brandonkelly]

Craft 3.6.7 is out now with this fix. Thanks again for reporting!