KasperskyLab / klara

Kaspersky's GReAT KLara
https://great.kaspersky.com
Other
693 stars 136 forks source link

Web - Login Attempt 404s #10

Closed lbontecou closed 6 years ago

lbontecou commented 6 years ago

Notes

Issue

image

xdanx commented 6 years ago

Hey,

That's strange, cause login attempts should go to /index.php/login/check. In order to make sure Code Igniter is set up properly, can you check you get a 200 (OK) when going to these pages:

/index.php/
/index.php/login/
/index.php/login/check

For the last page, you should get a 200 (OK) and a JSON: {"msg":"Invalid username or password","status":401}

lbontecou commented 6 years ago

Looks like it was a nginx configuration issue. I was previously using this:

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

Above wasn't using the php configs for anything not ending in .php I changed to the below and it began working.

    location ~ \.php.*$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }
xdanx commented 6 years ago

Yea. I suggest you shouldn't use the `.php.*$ pattern since it will force the fast-cgi interpreter to try to run any file having "php" in the extension. This could lead to problems in other scenarios, such as when users upload some data to your web server, and one user uploading a file called test.php.png embedding PHP code in the PNG file.

The correct way to set up Nginx and CodeIgniter is outlined here: https://www.nginx.com/resources/wiki/start/topics/recipes/codeigniter/