Check server rewrite permissions in the web installer

[digininja]

• OctoberCMS Build: whatever the latest is from the automatic installer
• PHP Version: 7.2
• Database Engine: mariadb
• Plugins Installed: None

Description:

The wizard installer doesn't check that mod_rewrite is installed so after the install has finished AJAX framework demo in here fails as you are walking through the first pages of the newly installed site

/demo/ajax

I assume the rest of the site also doesn't work but I fixed it before I tried.

It also doesn't check that htaccess is allowed to contain all the things it does. Mine wasn't and so various pages broke till I gave it permissions.

I can understand the CLI version missing things like this, but the wizard version is selling itself as a hands off installer which it isn't in this situation.

Steps To Reproduce:

Install the app without mod_rewrite enabled and with no permission for htaccess to override anything.

[LukeTowers]

@digininja do you know of a way to programmatically check for that? Also, keep in mind that October supports being run by more than just Apache, we also support nginx and IIS.

[digininja]

You could check for the mod_rewrite by trying to access a file which it gives you access to, if you get a 404 then it isn't in place.

Not sure about the htaccess, maybe put one in a directory and access a file in there, if you get a 500 then something is wrong. Do this before the rewrite as you use htaccess to set that up.

I'm sure there are plenty of ways to detect Apache Vs nginx etc.

On Mon, 8 Jun 2020, 17:33 Luke Towers, notifications@github.com wrote:

@digininja https://github.com/digininja do you know of a way to programmatically check for that? Also, keep in mind that October supports being run by more than just Apache, we also support nginx and IIS.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-640738232, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWOCUUMTXCEW7BO4NP3RVUHG5ANCNFSM4NYKWVDQ .

[bennothommo]

@digininja There's isn't really a reliable way to determine the availability of mod_rewrite directly - there is the apache_get_modules method that PHP provides, but it is only available if a) you're running Apache and b) you're running PHP as an Apache module (so not through CGI, FPM or a similar handler).

We could do a check to determine that a "rewritten" URL is accessible after installation, but that's about it.

[digininja]

You could do the check during the installation rather than after.

I'll see if I can knock something up that works.

On Tue, 9 Jun 2020, 02:22 Ben Thomson, notifications@github.com wrote:

@digininja https://github.com/digininja There's isn't really a reliable way to determine the availability of mod_rewrite directly - there is the apache_get_modules https://www.php.net/manual/en/function.apache-get-modules method that PHP provides, but it is only available if a) you're running Apache and b) you're running PHP as an Apache module (so not through CGI, FPM or a similar handler).

We could do a check to determine that a "rewritten" URL is accessible after installation, but that's about it.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-640972069, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWPHXHWYMQZZVADQMFLRVWFDVANCNFSM4NYKWVDQ .

[digininja]

Give this a try, it tries to make a request to a file in a directory which setups a rewrite rule with .htaccess. From my brief checks, if .htaccess isn't allowed, then the server gives back a 500, so detecting that suggests .htaccess failed. By requesting the file after the rewrite, if it gets a 404, then the rewrite failed so mod_rewrite isn't in place.

https://github.com/digininja/october_apache_test/tree/master

There are probably a load of other reasons these responses could be given, but if you use something like this in the installer, you could at least detect something is going wrong and warn the user during the install and give them suggestions on what to check for rather than leaving them with a broken page after the installer.

The code is scruffy and I've done no security checks, but hopefully it it will help.

[digininja]

This should work from any directory the CMS is installed into, I tried it in a random directory and in the root and both worked as expected, but that could do with a bit more checking, as could the way I pull out the current directory - that will fail if you have index.php in the URL, I couldn't remember if you did or not.

[bennothommo]

@digininja Makes sense. Would you be willing to provide a PR to the Installer repo that implements this check? I think it would need to happen after the rest of the installation steps are completed, to ensure that everything is set up correctly before the test occurs.

[LukeTowers]

@bennothommo is there something in the standard recommended server config that we could check to make sure it's working before the install process begins? Or is there something that we could put into the standard config?

[digininja]

I think it would be better to do these checks before the install rather than after. From memory you have a page that checked a few things that were needed were in place, it could go with those.

I think it would be better to warn the user earlier rather than later if things might not work for them.

And I'll see if I can do a PR, I've not looked at your code but it shouldn't be that hard to work out where to put things.

On Wed, 10 Jun 2020, 05:04 Luke Towers, notifications@github.com wrote:

@bennothommo https://github.com/bennothommo is there something in the standard recommended server config that we could check to make sure it's working before the install process begins? Or is there something that we could put into the standard config?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-641706797, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWKSYGDI5CK2O3BV2ZTRV4A4NANCNFSM4NYKWVDQ .

[bennothommo]

@LukeTowers we can do an attempted rewrite with a stub file (as @digininja's suggestion does), but my concern is that, at least for Apache hosts, this may not be reflective of the .htaccess file that our Installer downloads and installs.

[digininja]

I haven't dug into what other things the .htaccess puts in place but we might be able to check for those as well.

I think that even if we can't, at least making a few extra checks is worth doing. My install was on a freshly installed Debian box (I might have broken the htaccess permissions myself, I can't remember) but mod_rewrite was definitely not enabled by default, so that would be caught with this check.

On Wed, 10 Jun 2020 at 08:51, Ben Thomson notifications@github.com wrote:

@LukeTowers https://github.com/LukeTowers we can do an attempted rewrite with a stub file (as @digininja https://github.com/digininja's suggestion does), but my concern is that, at least for Apache hosts, this may not be reflective of the .htaccess file that our Installer downloads and installs.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-641806805, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWLOAJ2TK3WNTXDN6C3RV43R5ANCNFSM4NYKWVDQ .

[LukeTowers]

@bennothommo I haven't looked at the details of this at all, but shouldn't we be able to just have a route that should return a response if the server is configured correctly and do a JS call to that route (or routes if we wanted to get fancy and test every aspect of the default server config) to verify that the route returns the correct response?

[digininja]

I agree you could do the checks I did in PHP in JavaScript. I couldn't as I'm rubbish with JS, but it would work just the same.

You could do a page that returns the web server type so when you see different errors you could point them to the appropriate docs.

On Wed, 10 Jun 2020 at 18:16, Luke Towers notifications@github.com wrote:

@bennothommo https://github.com/bennothommo I haven't looked at the details of this at all, but shouldn't we be able to just have a route that should return a response if the server is configured correctly and do a JS call to that route (or routes if we wanted to get fancy and test every aspect of the default server config) to verify that the route returns the correct response?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-642145756, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWK2CF6KCOLW3VTK5BDRV65VDANCNFSM4NYKWVDQ .

[Samuell1]

Maybe something similar BoltCms did can be implemented in installer https://docs.bolt.cm/3.7/howto/making-sure-htaccess-works#test-if-mod-rewrite-is-working

[digininja]

That is pretty much what my script does mine is just slightly more granular to try to work out of it is htaccess or mod_rewrite is broken.

On Thu, 11 Jun 2020, 11:02 Samuell, notifications@github.com wrote:

Maybe something similar BoltCms did can be implemented in installer https://docs.bolt.cm/3.7/howto/making-sure-htaccess-works#test-if-mod-rewrite-is-working

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/octobercms/october/issues/5116#issuecomment-642545922, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA4SWJXMQX2XXPPDJWJCKTRWCTTFANCNFSM4NYKWVDQ .

[daftspunk]

ModRewrite is a common module and should be enabled for almost all web applications that use a .htaccess file.

Not sure if it is within the scope of an installer to check this. It's a cool idea to check for it programmatically but instead, we should just add it to the documentation as a server requirement for Apache, specifically

Thanks!