Problem/Motivation

The default Fast404 configuration includes image files and txt files, but not other file types that are routinely searched for by malicious users like .php, .json, .xml, .zip, .sql etc. As this setting is hidden from most users, this can cause bad performance on sites by default.

Proposed resolution

I can't think of any particular reason why it would be considered fine to default to a Fast404 page for a .jpg file that doesn't exist, but not for a .php file that doesn't exist. Is there a reason for this default behaviour that I'm not aware of?

Issue fork drupal-3630277

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mrdalesmith created an issue. See original summary.

chaitanyadessai made their first commit to this issue’s fork.

chaitanyadessai opened merge request !17413

chaitanyadessai’s picture

chaitanyadessai commented
Status: Active » Needs review

Please review MR.

mrdalesmith’s picture

mrdalesmith commented

Change looks good to me.

cilefen’s picture

cilefen commented
Component: routing system » system.module
cilefen’s picture

cilefen commented
Issue tags: +Needs change record
chaitanyadessai’s picture

chaitanyadessai commented
Issue tags: -Needs change record

Added a draft change record: https://www.drupal.org/node/3630396. It explains that existing sites are only updated if they still use the default fast_404.paths, and how sites with a custom pattern can add the new extensions.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs issue summary update, +Needs subsystem maintainer review

Would be good to get a full issue summary for reviewers.

Think it would be good to get system maintainer sign off too. Can be in review for that but NW for the summary.