[pkg-lighttpd] Bug#837696: lighttpd: CGI configuration doesn't define an alias for /cgi-bin/

Tue Sep 13 16:46:06 UTC 2016

Package: lighttpd
Version: 1.4.35-4+deb8u1
Severity: normal

Dear Maintainer,

In order to reproduce:

1. Install lighttpd
2. Run `lighty-enable-mod cgi`
3. Run `systemctl restart lighttpd`
4. Run `touch /usr/lib/cgi-bin/x`
5. Run `curl http://localhost/cgi-bin/x`

Actual outcome:

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
  <title>404 - Not Found</title>
 </head>
 <body>
  <h1>404 - Not Found</h1>
 </body>
</html>

Expected outcome:

[empty output]

The root cause is, that 10-cgi.conf doesn't define an alias
for /cgi-bin/. Adding this line

alias.url       += ( "/cgi-bin/" => "/usr/lib/cgi-bin/" )

would fix this issue and the root cause of #763618 as well.

-- System Information:
Debian Release: 8.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=ru_RU.utf8, LC_CTYPE=ru_RU.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages lighttpd depends on:
ii  init-system-helpers         1.22
ii  libattr1                    1:2.4.47-2
ii  libbz2-1.0                  1.0.6-7+b3
ii  libc6                       2.19-18+deb8u4
ii  libfam0                     2.7.0-17.1
ii  libldap-2.4-2               2.4.40+dfsg-1+deb8u2
ii  libpcre3                    2:8.35-3.3+deb8u4
ii  libssl1.0.0                 1.0.1t-1+deb8u2
ii  libterm-readline-perl-perl  1.0303-1
ii  lsb-base                    4.1+Debian13+nmu1
ii  mime-support                3.58
ii  perl                        5.20.2-3+deb8u6
ii  systemd                     215-17+deb8u4
ii  zlib1g                      1:1.2.8.dfsg-2+b1

Versions of packages lighttpd recommends:
ii  spawn-fcgi  1.6.4-1

Versions of packages lighttpd suggests:
ii  apache2-utils  2.4.10-10+deb8u5
ii  openssl        1.0.1t-1+deb8u2
pn  rrdtool        <none>

-- no debconf information

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-lighttpd-maintainers/attachments/20160913/eb7372fd/attachment.sig>