Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Due to a security vulnerability in Wordpress, a bunch of my posts got renamed to something like:

http://**MYSITE**/2008/08/21/**POSTNAME**/%&%28%7B$%7Beval%28base64_decode%28$_SERVER%5BHTTP_EXECCODE%5D%29%29%7D%7D%7C.+%29&%/

I've since fixed the problem, upgraded Wordpress, and also upgraded my Web server to Apache 2.2.3. The problem is, now I have a bunch of URLs that are indexed in Google and linked to from other sites. Google will eventually remove them from their index, but in the meantime I want to rewrite the bad URLs to correct URLs.

I've tried the following mod_rewrite rule, but it doesn't seem to work. It seems like Apache is seeing the request as "bad" and just returning an HTTP 400 error without ever consulting mod_rewrite (or mod_redirect). Here's the rule I've tried:

RewriteRule ^(20[0-9]{2}/[0-1][0-9]/[0-3][0-9]/[^/]+)/.*base64.*$ http://***MYSITE***/$1 [L,R=302,QSA]

Which matches when I test it in a regular expression tool, but doesn't seem to make any difference to Apache. Has anyone come across this problem? Any possible solution?

Thanks!

Chris

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You could define a custom ErrorDocument for the 400 Errors like so:

ErrorDocument 400 /cgi-bin/handle400.cgi

and then have that cgi (or php or servlet or whatever) do the header rewriting and location redirecting.



EDIT: because of Jacek's answer I just tested above solution to confirm it works on Apache 2.2.

My Server Config:

ScriptAlias     /cgi-bin/ "/var/www/cgi-bin/"
ErrorDocument   400 /cgi-bin/handle400.pl

lukas$ cat /var/www/cgi-bin/handle400.pl

#!/usr/bin/perl
print "Content-type: text/html\n\n";
while (my ($key, $val) = each %ENV) {
        print "$key = $val<BR>\n";
}
exit 0;

Now when accessing the broken URL that would produce an error 400 Bad Request before, I now get the following (partial) output:

...
REDIRECT_REQUEST_METHOD = GET
REDIRECT_STATUS = 400
REMOTE_ADDR = xx.xx.xx.xx
REQUEST_URI = /%&%28%7B$%7Beval%28base64_decode%28$_SERVER%5BHTTP_EXECCODE%5D%29%29%7D%7D%7C.+%29&%/
GATEWAY_INTERFACE = CGI/1.1
SCRIPT_URL = /cgi-bin/handle400.pl
...

So you do get enough information to do a proper status code change and location redirect.

share|improve this answer
    
Thanks! I had tried this method, but somehow managed to not get it working. I gave it another shot and it worked like a charm. –  inxilpro Mar 8 '10 at 17:24

'400 Bad request' means the request is so broken it cannot be parsed/understood by the server. That means the server has no data from the request (even the URL), so there is nothing mod_rewrite, or any other tool handling request data, can do about it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.