Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runtime error when using with OpenResty #32

Open
vsajip opened this issue May 30, 2023 · 0 comments
Open

Runtime error when using with OpenResty #32

vsajip opened this issue May 30, 2023 · 0 comments

Comments

@vsajip
Copy link

vsajip commented May 30, 2023

I'm getting an error using htaccess.lua with openresty/1.21.4.1 under the following circumstances:

  • I'm using the latest htaccess.lua from this repository. I've placed it in /usr/local/openresty/nginx/scripts.

  • I have a directory, /usr/local/openresty/nginx/html/protected, which I'm trying to protect using .htaccess.

  • The .htaccess file ( /usr/local/openresty/nginx/html/protected/.htaccess) contents are:

	AuthType Basic
	AuthName "Restricted Content"
	AuthUserFile .htpasswd
	Require valid-user
  • The nginx configuration (relevant portions) are:
http {
	...
	lua_shared_dict htaccess 4m;
	...
}

server {
	...
	rewrite_by_lua_file /usr/local/openresty/nginx/scripts/htaccess.lua;
	...

        location / {
            root   html;
            index  index.html index.htm;
        }
	...
}

When the rewrite_by_lua_file line is commented out, I can access content in /protected, as expected. When not commented out, access to /protected/index.html leads to a Lua runtime error:

2023/05/30 09:15:43 [error] 18532#18532: *17 lua entry thread aborted: runtime error: /usr/local/openresty/nginx/scripts/htaccess.lua:119: attempt to concatenate global 'doc_root' (a nil value)
stack traceback:
coroutine 0:
        /usr/local/openresty/nginx/scripts/htaccess.lua: in function 'ensure_doc_root'
        /usr/local/openresty/nginx/scripts/htaccess.lua:145: in function 'get_file_contents'
        /usr/local/openresty/nginx/scripts/htaccess.lua:507: in function 'parse_htaccess_directive'
        /usr/local/openresty/nginx/scripts/htaccess.lua:1012: in main chunk, client: 146.90.194.232, server: foo.bar.com, request: "GET /protected/index.html HTTP/2.0", host: "foo.bar.com"

Any idea what could be the cause of the problem? It seems like in

local ensure_doc_root = function(filepath)
if not in_doc_root(filepath) then
fail(C_SECURITY_VIOLATION_ERROR..': Trying to read file outside of server root directory ("'..doc_root..'"): "'..filepath..'"')
end
end

there's a reference to doc_root, which is not defined globally and is local to in_doc_root.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant