so this one is a weird one! I have these nginx stanzas. I used an online tool to convert .htaccess rules into nginx capable ones.
location / {
rewrite ^/(([^/]+/)*)login/$ /login.php?path=$1&$query_string break;
rewrite ^/(([^/]+/)*)comment/$ /comment.php?path=$1&$query_string break;
rewrite "^/([^/]+/){4}$" /asset.php break;
rewrite ^/(\d\w+)/$ /public.php?ticket=$1 break;
rewrite "^/(\d\w+)/([^/]+/){2}?$" /public-asset.php?ticket=$1 break;
if (!-e $request_filename){
rewrite ^/(([^/]+/)*) /index.php?path=$1&$query_string break;
}
try_files $uri $uri/ /index.php$is_args$args;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/var/run/php/vh1-fpm.sock;
include fastcgi_params;
}
going to https://example.test/ ok
going to https://example.test/login/ all heck break loose and PHP code is flooded onto the screen.
The regex routing works because the redirects take place. but once the redirect it done, it's like the masked .php file is not caught. All this is fixed if I encapsulate the PHP checks within the / location block.