Problem/Motivation

Nodes become inaccessible (403 HTTP code) when using a token which will generate a pattern starting with a dot.

Steps to reproduce

  1. Create an alias pattern with the title of the node as token for all content types
  2. Make sure that the "strings to remove" setting at /admin/config/search/path/settings has at least "a" in it to be removed
  3. Create a node with the title "A.Foo"
  4. The alias will be ".foo"
  5. In many well configured webservers this will result in a 403 HTTP code as the webserver prevents loading hidden files (which start with a dot)

Proposed resolution

Check that an alias can't start with a dot.

I'm not sure if this should be a setting or not. I can't find any reason (yet) why you really want to have an alias starting with a dot but if someone got a case, it should become a setting to disable removing a starting dot.

CommentFileSizeAuthor
#3 pathauto_test.png72.89 KBsijumpk
#2 remove-starting-dots.patch494 bytesRik Wijnen
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Rik Wijnen created an issue. See original summary.

Rik Wijnen’s picture

Rik Wijnen CreditAttribution: Rik Wijnen at Maastricht University commented
FileSize
remove-starting-dots.patch494 bytes

Patch added which could fix this.

sijumpk’s picture

sijumpk CreditAttribution: sijumpk at QED42 commented
FileSize
pathauto_test.png72.89 KB

Tried creating a node (without applying patch) with title "A.Foo" and the resulted url is /afoo, as expected. "a" is there in the "strings to remove" list while doing this. It seems like all dots are getting replaced irrespective of its position. Its done inside AliasCleaner::cleanString method. Is it just me who cannot reproduce this problem?

Meeni_Dhobale’s picture

Meeni_Dhobale CreditAttribution: Meeni_Dhobale as a volunteer and at QED42 for Drupal India Association commented

I also tried to reproduce this issue without applying the patch with title "A.Foo" and my URL is "/afoo". I didn't see any kind of 403 HTTP code. I am also not able to reproduce this issue.

Rik Wijnen’s picture

Rik Wijnen CreditAttribution: Rik Wijnen commented

I'm sorry, I realize that I was forgotten one setting;
In step 2, you have to select "no action (do not replace)" for "period (.)" in the "punctuation" section of /admin/config/search/path/settings too to make it break.

If you make sure "a" is in the list AND dots must not be replaced, a node with title "A.Foo" will result in url ".foo".

And yes, I'm telling the system to not replace dots but this is a special case because this one will break your site with widely used server configurations. Maybe it should be a setting in the module to prevent urls being starting with a dot, so it can be enabled if your webserver does not allow files and directories to begin with a dot.