Skip to content

fix: htaccess RewriteBase rules block API requests for files with common extensions - #41606

Merged
DeepDiver1975 merged 1 commit into
masterfrom
fix/htaccess-rewritebase-extension-blocking-api
Jun 9, 2026
Merged

fix: htaccess RewriteBase rules block API requests for files with common extensions#41606
DeepDiver1975 merged 1 commit into
masterfrom
fix/htaccess-rewritebase-extension-blocking-api

Conversation

@DeepDiver1975

Copy link
Copy Markdown
Member

Summary

  • Fixes jpg files cannot be marked as favorites #41418: files with extensions like .jpg, .png, .svg, .json etc. could not be marked as favorites when htaccess.RewriteBase is configured
  • Replaces the URI extension-based RewriteCond with RewriteCond %{REQUEST_FILENAME} \!-f, which correctly routes virtual API paths through index.php while still letting Apache serve real static assets directly
  • Adds a regression test verifying the generated .htaccess content uses the file-existence check and not the extension pattern

Root cause

updateHtaccess() in lib/private/Setup.php generated this condition when htaccess.RewriteBase was set:

RewriteCond %{REQUEST_URI} \!\.(css|js|svg|gif|png|html|ttf|woff|ico|jpg|jpeg|json|properties)$
RewriteCond %{REQUEST_URI} \!\.(min|js|auto)\.map$

The intent was to bypass PHP for static asset requests, but it matched on the URI string alone. So POST /apps/files/api/v1/files/photo.jpg — a valid API call — matched the .jpg exclusion and was never routed to index.php, causing a 405 Method Not Allowed response.

Fix

RewriteCond %{REQUEST_FILENAME} \!-f

%{REQUEST_FILENAME} resolves to the filesystem path. \!-f means "if no actual file exists at this path" — so real static files are served directly, and virtual API paths route through PHP.

Test plan

  • Mark a .jpg file as a favorite — should succeed (previously 405)
  • Mark a .png, .svg, .json file as favorite — same
  • Static assets (CSS, JS, images) still load correctly
  • Run tests/lib/SetupTest.php — new test testUpdateHtaccessWithRewriteBaseUsesFileExistenceCheck should pass
  • Requires htaccess.RewriteBase to be set in config.php to reproduce

🤖 Generated with Claude Code

@DeepDiver1975
DeepDiver1975 force-pushed the fix/htaccess-rewritebase-extension-blocking-api branch from a606fa3 to c2d640c Compare June 8, 2026 21:19
…ss RewriteBase block

When htaccess.RewriteBase is configured, the generated .htaccess excluded
requests whose URI ended in common extensions (jpg, png, svg, json, etc.)
from being routed through index.php. This blocked API requests like
POST /apps/files/api/v1/files/photo.jpg with 405 Method Not Allowed,
making it impossible to mark files with those extensions as favorites.

Replace the two extension-based RewriteCond lines with a single
`RewriteCond %{REQUEST_FILENAME} \!-f` check. This correctly routes virtual
API paths (no file on disk) through index.php while still letting Apache
serve actual static assets directly.

Fixes #41418

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
@DeepDiver1975
DeepDiver1975 force-pushed the fix/htaccess-rewritebase-extension-blocking-api branch from c2d640c to 831a8ef Compare June 8, 2026 21:39
Comment thread lib/private/Setup.php
*/
public static function updateHtaccess(): void {
$config = \OC::$server->getConfig();
public static function updateHtaccess(\OCP\IConfig $config): void {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder why we needed to getConfig here previously (and now pass it in)?

There is already a $config in this class that is initialised by anything that creates an instance of this class.

Anyway, I suppose that is history, and maybe the settings in $this->config get stale?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is all history ..... within this change I wanted to make the function testable but not fully refactor it all .... really not worth it ....

@DeepDiver1975
DeepDiver1975 merged commit 5bb332b into master Jun 9, 2026
13 checks passed
@DeepDiver1975
DeepDiver1975 deleted the fix/htaccess-rewritebase-extension-blocking-api branch June 9, 2026 07:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

jpg files cannot be marked as favorites

2 participants