fix: htaccess RewriteBase rules block API requests for files with common extensions - #41606
Merged
DeepDiver1975 merged 1 commit intoJun 9, 2026
Merged
Conversation
DeepDiver1975
force-pushed
the
fix/htaccess-rewritebase-extension-blocking-api
branch
from
June 8, 2026 21:19
a606fa3 to
c2d640c
Compare
…ss RewriteBase block
When htaccess.RewriteBase is configured, the generated .htaccess excluded
requests whose URI ended in common extensions (jpg, png, svg, json, etc.)
from being routed through index.php. This blocked API requests like
POST /apps/files/api/v1/files/photo.jpg with 405 Method Not Allowed,
making it impossible to mark files with those extensions as favorites.
Replace the two extension-based RewriteCond lines with a single
`RewriteCond %{REQUEST_FILENAME} \!-f` check. This correctly routes virtual
API paths (no file on disk) through index.php while still letting Apache
serve actual static assets directly.
Fixes #41418
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
DeepDiver1975
force-pushed
the
fix/htaccess-rewritebase-extension-blocking-api
branch
from
June 8, 2026 21:39
c2d640c to
831a8ef
Compare
phil-davis
approved these changes
Jun 9, 2026
| */ | ||
| public static function updateHtaccess(): void { | ||
| $config = \OC::$server->getConfig(); | ||
| public static function updateHtaccess(\OCP\IConfig $config): void { |
Contributor
There was a problem hiding this comment.
I wonder why we needed to getConfig here previously (and now pass it in)?
There is already a $config in this class that is initialised by anything that creates an instance of this class.
Anyway, I suppose that is history, and maybe the settings in $this->config get stale?
Member
Author
There was a problem hiding this comment.
this is all history ..... within this change I wanted to make the function testable but not fully refactor it all .... really not worth it ....
This was referenced Jul 27, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.jpg,.png,.svg,.jsonetc. could not be marked as favorites whenhtaccess.RewriteBaseis configuredRewriteCondwithRewriteCond %{REQUEST_FILENAME} \!-f, which correctly routes virtual API paths throughindex.phpwhile still letting Apache serve real static assets directly.htaccesscontent uses the file-existence check and not the extension patternRoot cause
updateHtaccess()inlib/private/Setup.phpgenerated this condition whenhtaccess.RewriteBasewas set:The intent was to bypass PHP for static asset requests, but it matched on the URI string alone. So
POST /apps/files/api/v1/files/photo.jpg— a valid API call — matched the.jpgexclusion and was never routed toindex.php, causing a 405 Method Not Allowed response.Fix
%{REQUEST_FILENAME}resolves to the filesystem path.\!-fmeans "if no actual file exists at this path" — so real static files are served directly, and virtual API paths route through PHP.Test plan
.jpgfile as a favorite — should succeed (previously 405).png,.svg,.jsonfile as favorite — sametests/lib/SetupTest.php— new testtestUpdateHtaccessWithRewriteBaseUsesFileExistenceCheckshould passhtaccess.RewriteBaseto be set inconfig.phpto reproduce🤖 Generated with Claude Code