diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index d9ad856..a77e3c5 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -657,13 +657,6 @@ function drupal_environment_initialize() {
     $_SERVER['HTTP_HOST'] = '';
   }
 
-  // When clean URLs are enabled, emulate ?q=foo/bar using REQUEST_URI. It is
-  // not possible to append the query string using mod_rewrite without the B
-  // flag (this was added in Apache 2.2.8), because mod_rewrite unescapes the
-  // path before passing it on to PHP. This is a problem when the path contains
-  // e.g. "&" or "%" that have special meanings in URLs and must be encoded.
-  $_GET['q'] = request_path();
-
   // Enforce E_ALL, but allow users to set levels not part of E_ALL.
   error_reporting(E_ALL | error_reporting());
 
@@ -782,6 +775,13 @@ function drupal_settings_initialize() {
   }
   $prefix = ini_get('session.cookie_secure') ? 'SSESS' : 'SESS';
   session_name($prefix . substr(hash('sha256', $session_name), 0, 32));
+
+  // When clean URLs are enabled, emulate ?q=foo/bar using REQUEST_URI. It is
+  // not possible to append the query string using mod_rewrite without the B
+  // flag (this was added in Apache 2.2.8), because mod_rewrite unescapes the
+  // path before passing it on to PHP. This is a problem when the path contains
+  // e.g. "&" or "%" that have special meanings in URLs and must be encoded.
+  $_GET['q'] = request_path();
 }
 
 /**
@@ -2729,9 +2729,10 @@ function request_path() {
     // This request is either a clean URL, or 'index.php', or nonsense.
     // Extract the path from REQUEST_URI.
     $request_path = strtok($_SERVER['REQUEST_URI'], '?');
-    $base_path_len = strlen(rtrim(dirname($_SERVER['SCRIPT_NAME']), '\/'));
-    // Unescape and strip $base_path prefix, leaving q without a leading slash.
-    $path = substr(urldecode($request_path), $base_path_len + 1);
+    // Remove any subdirectories from the path that are included in $base_url.
+    global $base_url;
+    $base_url_len = strlen(parse_url($base_url, PHP_URL_PATH));
+    $path = substr(urldecode($request_path), $base_url_len + 1);
     // If the path equals the script filename, either because 'index.php' was
     // explicitly provided in the URL, or because the server added it to
     // $_SERVER['REQUEST_URI'] even when it wasn't provided in the URL (some
diff --git a/modules/simpletest/tests/bootstrap.test b/modules/simpletest/tests/bootstrap.test
index 014fc94..6633f4c 100644
--- a/modules/simpletest/tests/bootstrap.test
+++ b/modules/simpletest/tests/bootstrap.test
@@ -321,6 +321,54 @@ class HookBootExitTestCase extends DrupalWebTestCase {
 }
 
 /**
+ * Test bootstrapping Drupal in a subdirectory with a rewrite.
+ * See related issue: http://drupal.org/node/757506
+ */
+class SubdirectoryRewriteTestCase extends DrupalWebTestCase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Bootstrap Drupal when request rewritten to subdirectory',
+      'description' => 'Test that Drupal boostraps properly when it is installed in a subdirectory, and the request URI is rewritten to remove the subdirectory.',
+      'group' => 'Bootstrap',
+    );
+  }
+
+  function setUp() {
+    parent::setUp('system_test');
+
+    // Create and log in our privileged user.
+    $this->privileged_user = $this->drupalCreateUser(array(
+      'access administration pages',
+    ));
+    $this->drupalLogin($this->privileged_user);
+  }
+
+  /**
+   * Test that Drupal boostraps properly when it is installed in a subdirectory that requests are rewritten into.
+   */
+  function testSubdirectoryRewrite() {
+    // Test that a rewritten request to admin/config is successful.
+    $this->drupalGet($this->subdirRewriteRequestUrl('admin/config'));
+    $this->assertResponse(200);
+  }
+
+  /**
+   * Builds a URL for submitting a mock request which pretends it has been rewritten.
+   *
+   * @param $url
+   *   A Drupal path such as 'user'.
+   *
+   * @return
+   *   An absolute URL.
+   */
+  protected function subdirRewriteRequestUrl($url) {
+    global $base_url;
+    return $base_url . '/modules/simpletest/tests/subdir_rewrite.php?q=' . $url;
+  }
+}
+
+/**
  * Test drupal_get_filename()'s availability.
  */
 class BootstrapGetFilenameTestCase extends DrupalUnitTestCase {
diff --git a/modules/simpletest/tests/subdir_rewrite.php b/modules/simpletest/tests/subdir_rewrite.php
new file mode 100644
index 0000000..7f9c5b0
--- /dev/null
+++ b/modules/simpletest/tests/subdir_rewrite.php
@@ -0,0 +1,44 @@
+<?php
+
+/**
+ * @file
+ * Fake an HTTP request rewrite into a subdirectory.
+ * See issue: http://drupal.org/node/757506
+ */
+
+// Replace all occurrences of subdir_rewrite.php with index.php.
+foreach ($_SERVER as $key => $value) {
+  $_SERVER[$key] = str_replace('modules/simpletest/tests/subdir_rewrite.php', 'index.php', $value);
+}
+
+// Convert the requested URI to a clean URL.
+$_SERVER['REQUEST_URI'] = str_replace('index.php?q=', '', $_SERVER['REQUEST_URI']);
+
+// Build the $base_url from $_SERVER['HTTP_HOST'], including the subdirectory
+// that Drupal is installed in (if any).
+$base_url = 'http://' . $_SERVER['HTTP_HOST'];
+if ($dir = rtrim(dirname($_SERVER['SCRIPT_NAME']), '\/')) {
+  $base_url .= $dir;
+}
+
+// Pretend that Drupal is installed in a subdirectory within the $base_url.
+// This represents the subdirectory that requests are being rewritten into.
+$_SERVER['SCRIPT_NAME'] = '/sub' . $_SERVER['SCRIPT_NAME'];
+
+// Unset $_GET['q'] so that request_path() generates a new path.
+unset($_GET['q']);
+
+// Change current directory to the Drupal root.
+chdir('../../..');
+define('DRUPAL_ROOT', getcwd());
+require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
+
+// Make sure this file can only be used by simpletest.
+drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION);
+if (!drupal_valid_test_ua()) {
+  header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+  exit;
+}
+
+drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
+menu_execute_active_handler();