2

I use and need php_fpm7.0 on debian 9 (stretch) apache 2.4.25. DocumentRoot is /var/www/html and works well. Php enabled, scripts executed etc... Now I also want to serve the same arborescence as a filesystem via apache dav_fs module.

To do this :

  1. /var/www/webdav is a symlink to /var/www/html so I can name the same directory with 2 different names in apache config file, and so create 2 distinct configurations based on access name
  2. I access webdav with /webdav URL. Inside apache config, /webdav is an alias that points to /var/www/webdav. Now I only need to setup the <Directory /var/www/webdav> section and everything should be good.

So far, it almost works : I can get and put files, create directories, rename files etc... with webdav, but PHP files continue to be executed when I GET them via the webdav alias. So if I want to edit a .php file, I indeed get the result of the script in my editor, which is useless.

My setting so far :

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory /var/www/html>
        AllowOverride All
        require all granted
        Options Indexes FollowSymLinks MultiViews
    </Directory>

    Alias /webdav /var/www/webdav
    <Directory /var/www/webdav>
        SetHandler none
        Options -ExecCGI -FollowSymLinks -Includes -Indexes -MultiViews
        AddType text/plain php php3 php4 php5 php7 php8 pht phptml phps
        AllowOverride None
        DAV On
        <ifmodule mod_dir.c>
            DirectoryIndex disabled
        </ifmodule>
        <ifmodule mod_rewrite.c>
            RewriteEngine Off
        </ifmodule>
        <Files ~ "^\.ht"> # need to be able to edit .htaccess files.
            require all granted
        </Files>
    </Directory>
</VirtualHost>

What is the correct way to prevent php execution in /var/www/webdav directory ?

Edit and Solution

Since Debian uses SetHandler "proxy:unix:/run/php/php7.0-fpm.sock|fcgi://localhost" /etc/apache2/conf-available/php7.0-fpm.conf, I have to use SetHandler none. But in the <Directory> section, this is too late. it must be used in <Location>, this is interpreted early enough. I also included ProxyPass ! as @exussum suggests (should be placed in <Location> ?). It is useles in this precise case, but proxy is certainly unwanted here anyway.

Also note that I had to put the authentication/authorization in <Directory>. It worked in <Location>, but only the CLI cadaver client could access the webdav collection. When authentication/authorization is in <Directory>, the nautilus filemanager could access the files.

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory /var/www/html>
        AllowOverride All
        require all granted
        Options Indexes FollowSymLinks MultiViews
    </Directory>

    Alias /webdav /var/www/webdav
    <Location /webdav>
        <IfModule mod_proxy.c>
            ProxyPass !
        </IfModule>
        SetHandler none
        AddType text/plain php php3 php4 php5 php7 php8 pht phptml phps
    </Location>
    <Directory /var/www/webdav>
        AuthName "Restricted Area"
        AuthType Basic
        AuthUserFile    "/etc/apache2/user-password"
        require valid-user
        Options -ExecCGI -FollowSymLinks -Includes -Indexes -MultiViews
        AllowOverride None
        DAV On
        <ifmodule mod_dir.c>
            DirectoryIndex disabled
        </ifmodule>
        <ifmodule mod_rewrite.c>
            RewriteEngine Off
        </ifmodule>
        <Files ~ "^\.ht"> # need to be able to edit .htaccess files.
            require all granted
        </Files>
    </Directory>
</VirtualHost>
2

as your using fpm, You need to send the request to FPM at some point

Usually its like this

ProxyPassMatch ^/(.*\.php(/.*)?)$ unix:/path/to/socket.sock

or similar. (see https://wiki.apache.org/httpd/PHP-FPM for other options)

You need the files to not hit this have your Directory block use ProxyPass ! to stop them being passed over

  • good idea. unfortunately, ProxyPassMatch can't be used in Directory. So it gave me the idea to try in <Location /webdav>. There the directive is legal, but does not work. It just happen that debian 9 uses SetHandler "proxy:unix:/run/php/php7.0-fpm.sock|fcgi://localhost", not ProxyPassMatch ... and so the solution is setHandler none. I can't mark your answer as correct since it does not work, but without it I would have definitely not found the solution. So a big thank you. – exore Jan 21 '18 at 12:34
  • +1 because your answer, and the link make sense – exore Jan 21 '18 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.