Is this ok? (using [OR])

[saquilina]

Hello, I have the following .htaccess rules and conditions...

RewriteCond %{QUERY_STRING} proc\/self\/environ [OR]
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} base64_decode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

I am testing these rules from [htaccess.madewithlove.be...] The test indicates that even though none of the RewriteCond are met, the RewriteRule is still done because of the [OR].

The exact result is "This condition was not met but the previous OR option made it pass". So does this mean that the RewriteRule will always be executed and that the RewriteCond are for nothing?

Is this right? Or maybe the tester is not working as should?

[wilderness]

Hardly!

A 13YO boy goes into Hooters and requests a double-scotch.
"Lets see some ID".
"This ID says your only 13YO"
"Here's your double-scotch"

The use of [OR] applies that any of the conditions apply the Rule.

If you desire NOt of the Conditions to apply the Rule than lead the string anchor with an exclamation point !
EX:

!proc\/self\/environ [OR]

[saquilina]

These rules are meant for a joomla site in order to block out some common exploits. I understand that the [OR] is there so that if any of the RewriteCond is true, then the RewriteRule is processed. What I can't understand is why the RewriteRule is being processed even when all RewriteCond return false. The last RewriteCond does not end with an [OR] and therefore can't understand why the tester is saying "This condition was not met but the previous OR option made it pass" since even the previous RewriteCond returned false.

Is this how it should work? or this is a problem with the testing tool?

[lucy24]

Is this how it should work? or this is a problem with the testing tool?

If the testing tool is the one saying

even though none of the RewriteCond are met, the RewriteRule is still done because of the [OR].

then there most emphatically is a problem with the tool.

Real-life testing is definitely more reliable, though riskier since you can bring your whole site crashing to a halt. If your server allows it, make a dummy directory with its own htaccess and a couple of assorted files, and use that for your experimenting.

None of your test patterns contain anchors, so they all mean "query string contains this piece" rather than "query string begins or ends with, or is exactly equal to, this text". Is that what you intended?

The last two conditions, especially, look perilously generic.

RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2})
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

That's: query string contains
GLOBALS=
GLOBALS[
GLOBALS%
and same for _REQUEST
Since there's no $ ending anchor, the [0-9A-Z]{0,2} part doesn't mean anything.

:: looking vaguely around for g1smd now that I have got my jaw successfully wired back into place ::

[wilderness]

Is this how it should work? or this is a problem with the testing tool?

It should work as I previously explained, and if you don't have the functioning rule in place and on a functioning website, whilst getting an invalid response?

The syntax of the testing tool and the person (s) who configured it are less-than-capable of their understanding, and/or the ability to implement the correct syntax into their supposed functioning tool.

[g1smd]

That's very old Joomla code, certainly not recommended for use now.

You should upgrade your file to a new version. Look for the "htaccess.txt" file that comes with Joomla 1.5.23 or later, or with Joomla 1.6.2 or later.

The new file contains a number of important changes. The new file is compatible with all previous versions of Joomla.

Even if you have upgraded the rest of your Joomla installation, you'll still need to manually upgrade the .htaccess file yourself.