Error with config when upgrading from 0.6.34 to 0.7.59 (the "alias" directive must use captures inside location given by regular expression)

[Igor Sysoev]

On Sat, Jun 20, 2009 at 04:27:58PM +0100, Jools Wills wrote:

> On Thu, 2009-06-18 at 11:41 +0400, Igor Sysoev wrote:
> 
> >   locaiton ~ ^/~([^/]+)(/?.*)$) { (i changed to location ~ ^/~([^/]+)(/?.*)$ {)
> >       alias /home/$1/public_html/$2;
> >       autoindex on;
> >   }
> 
> this works well thanks. Are there any security risks with this? For
> example could it be abused to gain access to another folder by using a
> specific path ?

nginx normilizes ".." in URI, i.e., "/~user/../dir/file" becomes
"/dir/file" and will not match this location.

"/~user/dir/../file" becomes "/~user/file" and will be mapped by "alias"
to "/home/user/public_html/file".


-- 
Igor Sysoev
http://sysoev.ru/en/