tweak rewrite conditions in htaccess

[C0rby]

This change hardens the rewrite rules to match the exact paths we want and not any subpaths e.g. /somefolder/status.php.

Thanks to Terry Franklin, Matt Harris, Hayden Barker and Colin Smith (aka yoloClin) from Radiant Security (https://radiant.security) for reporting this.

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[ownclouders]

💥 Acceptance tests pipeline cliCreateLocalStorage-mariadb10.2-php7.4 failed. The build has been cancelled.

https://drone.owncloud.com/owncloud/core/37812/105

[C0rby]

@IljaN, could you maybe tell me why the test is failing?
I'm not sure if this is because of my change.

[DeepDiver1975]

@IljaN, could you maybe tell me why the test is failing?
I'm not sure if this is because of my change.

yes - it is related.

There is some code somewhere which is doing magic on htaccess.
Due to these changes this is falling apart ....

[DeepDiver1975]

core/tests/acceptance/run.sh

Line 764 in 32b6984

remote_occ ${ADMIN_AUTH} ${OCC_URL} "config:system:set htaccess.RewriteBase --value /${WEBSERVER_PATH}/"

[mdusher]

It may be worth looking at swapping %{REQUEST_FILENAME} out for %{REQUEST_URI} as according to the mod_rewrite documentation (https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html) there is some cases where %{REQUEST_FILENAME} can resolve to the full local path of the script/file (eg. /var/www/owncloud/status.php instead /status.php) which would break those RewriteCond rules.

[C0rby]

It may be worth looking at swapping %{REQUEST_FILENAME} out for %{REQUEST_URI} as according to the mod_rewrite documentation (https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html) there is some cases where %{REQUEST_FILENAME} can resolve to the full local path of the script/file (eg. /var/www/owncloud/status.php instead /status.php) which would break those RewriteCond rules.

That is actually why the CI failed.... Thanks for the hint. 👍

[phil-davis]

@C0rby is a changelog needed for this?

[C0rby]

@C0rby is a changelog needed for this?

I added one. 👍

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication

Comment is resolved now.

[C0rby]

Problem could be cause by new adding ^ not match by e.g. /owncloud/remote.php if use sub-dir install?

I did test sub-dir installations and that worked at that time but maybe I've missed something.

[IljaN]

Potential fix here: #40697