Why does Apache execute php file on calling file without extension

Question

Today I found a strange thing on my server. I created a php file (test.php) and wrote some php codes inside it. then I call it using

http://127.0.0.1/test

and the "test.php" executed ! How does it understand to run test.php when there is no .php ? there is no htaccess file on my root directory to tell the apache do that. I guess it may causes security problem. How can I prevent it ?

My OS is ubuntu and the web server is Apache2.

How does that cause a security problem? If someone can access example.com/test they can just as well access example.com/test.php. — JJJ
– JJJ, Commented Apr 8, 2012 at 9:07

V13 · Accepted Answer · 2013-03-29 23:55:30Z

7

This happens because of MultiViews (it's enabled somewhere in the "Options" for that directory).

Have a look here: http://httpd.apache.org/docs/current/content-negotiation.html#negotiation for details on how it works.

answered Mar 29, 2013 at 23:55

V13

1,15312 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Owen Over a year ago

This is indeed the reason.

Magnolia · Accepted Answer · 2012-04-08 09:04:50Z

3

Check your apache config (/etc/apache2/sites-available/[site_name or default]), it probably contains mod_rewrite instructions, for example:

RewriteEngine on
RewriteBase /
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^(([^/]+/)*[^.]+)$ /$1.php [L]

If you comment them out with # and restart apache, accessing /test without specifying extension should no longer work.

answered Apr 8, 2012 at 9:04

Magnolia

312 bronze badges

Collectives™ on Stack Overflow

Why does Apache execute php file on calling file without extension

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related