Force proxy off

jsonger

I'm testing Files out and I'm operating on an alias path with Apache. As a result Files is trying to proxy everything even though there is clear access to the files. Is there a way to force the proxy off (and specify a prefix if needed) in this situation?

Karl

🔥 Edit: Ignore this post, and see my next post. 🔥

jsonger I'm not sure you will read this late reply, but will post anyway.

I was looking into this, as it would seem better to keep the public symlink url instead of using PHP proxy. However, the reason PHP proxy is used in the first place, is because the symlink target file is not within the Apache $_SERVER['DOCUMENT_ROOT'], and if you try to serve a file in browser by symlink that is not within document root, you will get 403 - Forbidden response (regardless of file permissions).

When using PHP proxy on the other hand, it works fine, as long as the symlink target has read permissions for the PHP user. PHP is not under the same limitations as Apache, which is not allowed to access files outside of DOCUMENT_ROOT, without help from PHP.

Therefore, it seems like a bad idea to try to load symlink paths directly in browser, unless we know for sure they point to files that are within DOCUMENT_ROOT. In your case, they are not, because Files Gallery will only proxy by PHP in the first place, if the file is outside DOCUMENT_ROOT. You can try yourself.

Karl

You mean the alias path is accessible directly in browser, right? I think this is what is happening:

Files Gallery resolves all aliases to real paths, because it mostly makes sense when working with file paths.
I'm assuming the real path of your files is outside the web server document root? In which case, Files Gallery considers the path inaccessible, and creates a proxy.

I can see how it would be more optimal to keep alias paths, but right now there is no option for this. You would need to dig around in the PHP code, but I don't have a recipe. I will definitely be looking into this.

Karl

It seems I was wrong in my previous post. Loading symlinks in browser seems to mostly allow access to files that are outside of $_SERVER['DOCUMENT_ROOT']. My test above was from the Mac /User/Downloads folder, which seems to have some specific access permissions, and in this case, PHP wasn't even allowed to proxy the file.

Therefore, in next release, I will attempt to keep symlink paths in browser, instead of using proxy by PHP, even if the symlink target is outside DOCUMENT_ROOT.

I'm not 100% sure this will work across all server combinations, but I think it's worth trying. If not, we might need an option like the existing load_files_proxy_php, that only loads files by proxy if the file is outside document_root. However, if this file is not accessible by Apache, it's likely the file is not readable by PHP either.

Just taking some notes!

Karl

In latest release, symlink paths will load directly in browser, bypassing PHP proxy, if target is not in document root.
https://www.files.gallery/blog/files-0-9-0/