Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

errors/local.xml and error page templates are publicly accessible #20209

Closed
schmengler opened this issue Jan 11, 2019 · 10 comments
Closed

errors/local.xml and error page templates are publicly accessible #20209

schmengler opened this issue Jan 11, 2019 · 10 comments
Assignees
@schmengler
Labels
Component: Config Fixed in 2.2.x The issue has been fixed in 2.2 release line Fixed in 2.3.x The issue has been fixed in 2.3 release line Issue: Clear Description Gate 2 Passed. Manual verification of the issue description passed Issue: Confirmed Gate 3 Passed. Manual verification of the issue completed. Issue is confirmed Issue: Format is valid Gate 1 Passed. Automatic verification of issue format passed Issue: Ready for Work Gate 4. Acknowledged. Issue is added to backlog and ready for development Progress: PR Created Indicates that Pull Request has been created to fix issue Reproduced on 2.2.x The issue has been reproduced on latest 2.2 release Reproduced on 2.3.x The issue has been reproduced on latest 2.3 release

Comments

@schmengler
Copy link
Contributor

schmengler commented Jan 11, 2019 •
edited
Loading

Preconditions (*)

All current Magento 2 versions:

  1. 2.3.0
  2. 2.2.7
  3. 2.1.16

Using default apache or nginx configuration with pub as doc root

Steps to reproduce (*)

For PHTML files:

  1. Point browser to /errors/default/page.phtml

For local.xml:

  1. Copy pub/errors/local.xml.sample to pub/errors/local.xml
  2. Point browser to /errors/local.xml

Expected result (*)

  1. A "not found" or "forbidden" response

Actual result (*)

  1. The source files are served
@magento-engcom-team
Copy link
Contributor

magento-engcom-team commented Jan 11, 2019 •
edited by schmengler
Loading

Hi @schmengler. Thank you for your report.
To help us process this issue please make sure that you provided the following information:

  • Summary of the issue
  • Information on your environment
  • Steps to reproduce
  • Expected and actual results

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento-engcom-team give me $VERSION instance

where $VERSION is version tags (starting from 2.2.0+) or develop branches (for example: 2.3-develop).
For more details, please, review the Magento Contributor Assistant documentation.

@schmengler do you confirm that you was able to reproduce the issue on vanilla Magento instance following steps to reproduce?

  • yes
  • no

@magento-engcom-team magento-engcom-team added the Issue: Format is valid Gate 1 Passed. Automatic verification of issue format passed label Jan 11, 2019
@ghost ghost self-assigned this Jan 11, 2019
@magento-engcom-team
Copy link
Contributor

magento-engcom-team commented Jan 11, 2019 •
edited by ghost
Loading

Hi @engcom-backlog-nazar. Thank you for working on this issue.
In order to make sure that issue has enough information and ready for development, please read and check the following instruction: 👇

  • 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).

    DetailsIf the issue has a valid description, the label Issue: Format is valid will be added to the issue automatically. Please, edit issue description if needed, until label Issue: Format is valid appears.

  • 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue. If the report is valid, add Issue: Clear Description label to the issue by yourself.

  • 3. Add Component: XXXXX label(s) to the ticket, indicating the components it may be related to.

  • 4. Verify that the issue is reproducible on 2.3-develop branch

    Details- Add the comment @magento-engcom-team give me 2.3-develop instance to deploy test instance on Magento infrastructure.
    - If the issue is reproducible on 2.3-develop branch, please, add the label Reproduced on 2.3.x.
    - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!

  • 5. Verify that the issue is reproducible on 2.2-develop branch.

    Details- Add the comment @magento-engcom-team give me 2.2-develop instance to deploy test instance on Magento infrastructure.
    - If the issue is reproducible on 2.2-develop branch, please add the label Reproduced on 2.2.x

  • 6. Add label Issue: Confirmed once verification is complete.

  • 7. Make sure that automatic system confirms that report has been added to the backlog.

@ghost ghost added the Issue: Clear Description Gate 2 Passed. Manual verification of the issue description passed label Jan 11, 2019
@schmengler
Copy link
Contributor Author

@magento-engcom-team give me 2.3.0 instance

@magento-engcom-team
Copy link
Contributor

Hi @schmengler. Thank you for your request. I'm working on Magento 2.3.0 instance for you

@magento-engcom-team
Copy link
Contributor

Hi @schmengler, here is your Magento instance.
Admin access: https://i-20209-2-3-0.instances.magento-community.engineering/admin
Login: admin Password: 123123q
Instance will be terminated in up to 3 hours.

@ghost
Copy link

ghost commented Jan 11, 2019

hi @schmengler did you configure docroot to pub ?

@schmengler
Copy link
Contributor Author

schmengler commented Jan 11, 2019 •
edited
Loading

@engcom-backlog-nazar yes, I should have mentioned it, sorry.

In the instance above it seems not to be the case, but I can access for example: https://i-20209-2-3-0.instances.magento-community.engineering/pub/errors/local.xml.sample

local.xml does not exist on vanilla instance and PHTML files seem to be parsed as PHP, so for example https://i-20209-2-3-0.instances.magento-community.engineering/pub/errors/page.phtml results in

<!doctype html>
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
    <title>

it terminates with an error at <?= $this->pageTitle ?>

@ghost ghost added Component: Config Reproduced on 2.3.x The issue has been reproduced on latest 2.3 release Reproduced on 2.2.x The issue has been reproduced on latest 2.2 release labels Jan 11, 2019
@schmengler schmengler mentioned this issue Jan 11, 2019
Merged
4 tasks
@ghost ghost added the Issue: Confirmed Gate 3 Passed. Manual verification of the issue completed. Issue is confirmed label Jan 11, 2019
@ghost ghost removed their assignment Jan 11, 2019
@magento-engcom-team
Copy link
Contributor

@engcom-backlog-nazar Thank you for verifying the issue. Based on the provided information internal tickets MAGETWO-97575, MAGETWO-97576 were created

@magento-engcom-team magento-engcom-team added the Issue: Ready for Work Gate 4. Acknowledged. Issue is added to backlog and ready for development label Jan 11, 2019
@ghost ghost added the Progress: PR Created Indicates that Pull Request has been created to fix issue label Jan 11, 2019
@magento-engcom-team
Copy link
Contributor

Hi @schmengler. Thank you for your report.
The issue has been fixed in #20212 by @schmengler in 2.3-develop branch
Related commit(s):

The fix will be available with the upcoming 2.3.2 release.

@magento-engcom-team magento-engcom-team added the Fixed in 2.3.x The issue has been fixed in 2.3 release line label Mar 26, 2019
@amol2jcommerce amol2jcommerce mentioned this issue Mar 26, 2019
Merged
4 tasks
@magento-engcom-team
Copy link
Contributor

Hi @schmengler. Thank you for your report.
The issue has been fixed in #21946 by @amol2jcommerce in 2.2-develop branch
Related commit(s):

The fix will be available with the upcoming 2.2.9 release.

@magento-engcom-team magento-engcom-team added the Fixed in 2.2.x The issue has been fixed in 2.2 release line label Apr 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@schmengler schmengler

Labels
Component: Config Fixed in 2.2.x The issue has been fixed in 2.2 release line Fixed in 2.3.x The issue has been fixed in 2.3 release line Issue: Clear Description Gate 2 Passed. Manual verification of the issue description passed Issue: Confirmed Gate 3 Passed. Manual verification of the issue completed. Issue is confirmed Issue: Format is valid Gate 1 Passed. Automatic verification of issue format passed Issue: Ready for Work Gate 4. Acknowledged. Issue is added to backlog and ready for development Progress: PR Created Indicates that Pull Request has been created to fix issue Reproduced on 2.2.x The issue has been reproduced on latest 2.2 release Reproduced on 2.3.x The issue has been reproduced on latest 2.3 release
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@schmengler @magento-engcom-team