Debian packages for CVE-2013-4547

2013-11-21 Thread Christos Trochalakis
On Tue, Nov 19, 2013 at 07:02:21PM +0400, Maxim Dounin wrote: Hello! Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other imp

Debugging and ubuntu

2013-11-21 Thread Ian Evans
Been running nginx for _years_ on centos and am in the process of migrating to an Ubuntu (raring) server. I've always compiled from source before but figured I'd use the Ubuntu apt-get install. For whatever reason, testing is not working at all (I can serve static but not php) and I set the

Re: Clean-URL rewrite rule with nested "location" and alias directive

2013-11-21 Thread Francis Daly
On Thu, Nov 21, 2013 at 08:45:02PM +, Francis Daly wrote: > On Wed, Nov 20, 2013 at 10:31:07PM -0500, Ben Johnson wrote: ...and one more possibility... If your application directory structure is such that: /var/www/myapp/web/ contains only static files that should be served as-is if reque

Re: Intermittant SSL Problems

2013-11-21 Thread Will Pugh
Cool. Thanks! Initial testing looks like this fixed it. --Will On Thu, Nov 21, 2013 at 3:34 AM, Maxim Dounin wrote: > Hello! > > On Wed, Nov 20, 2013 at 06:03:11PM -0800, Will Pugh wrote: > > > Hi folks, > > > > We are using Nginx for SSL termination, and then it proxies to an ATS or > >

Re: Nginx Websocket proxy with Microsoft IE 10 client

2013-11-21 Thread Alder Network
when client is Internet Explorer 10, the websocket session didn't get proxy'd to websocket server (websocketpp) other browser clients work fine. On Thu, Nov 21, 2013 at 12:48 AM, Maxim Dounin wrote: > Hello! > > On Wed, Nov 20, 2013 at 03:17:11PM -0800, Alder Network wrote: > > > Is that a kno

Re: Clean-URL rewrite rule with nested "location" and alias directive

2013-11-21 Thread Francis Daly
On Wed, Nov 20, 2013 at 10:31:07PM -0500, Ben Johnson wrote: > On 11/20/2013 4:10 AM, Francis Daly wrote: Hi there, > > If you do have free choice in the matter, some things work more easily > > within nginx if you can use "root" and not "alias" -- so if you want > > files to be accessible below

Re: 回复： nginx security advisory (CVE-2013-4547)

2013-11-21 Thread Maxim Dounin
Hello! On Thu, Nov 21, 2013 at 05:15:58PM +0800, yzprofile wrote: > Hi, > > I have a question with this POC: > > > location /protected/ { > > deny all; > > } > > > > location ~ \.php$ { > > fastcgi_pass ... > > } > > > These locations own different priorities, > http://nginx.org/en/docs/

Re: Intermittant SSL Problems

2013-11-21 Thread Maxim Dounin
Hello! On Wed, Nov 20, 2013 at 06:03:11PM -0800, Will Pugh wrote: > Hi folks, > > We are using Nginx for SSL termination, and then it proxies to an ATS or > Haproxy server depending on our environment. > > We're running into a problem where every now and then, Nginx closes a > connection due to

回复： nginx security advisory (CVE-2013-4547)

2013-11-21 Thread yzprofile
Hi, I have a question with this POC: > location /protected/ { > deny all; > } > > location ~ \.php$ { > fastcgi_pass ... > } These locations own different priorities, http://nginx.org/en/docs/http/ngx_http_core_module.html#location I think every request like “/protected/hello.php” can byp

Re: Nginx Websocket proxy with Microsoft IE 10 client

2013-11-21 Thread Maxim Dounin
Hello! On Wed, Nov 20, 2013 at 03:17:11PM -0800, Alder Network wrote: > Is that a known issue? Any remedy available? What's the issue? -- Maxim Dounin http://nginx.org/en/donation.html ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/