5

I have an HTML page with the following:

<img src=J3 width="100" height="150" alt="Student Name" style="float:left;"/>

In the same directory there is an image file, J3.jpg. The page containing the above image element successfully loads the image file, and I cannot figure out why. (I know the src= attribute is mangled; I am a college teacher and this is student work.)

Each student's work in in /home/userid/public_html. Here is the relevant section of /etc/httpd/conf/httpd.conf:

<Directory /home/*/public_html>
    AllowOverride FileInfo AuthConfig Limit
    Options SymLinksIfOwnerMatch IncludesNoExec
    <Limit GET POST OPTIONS>
        Order allow,deny
        Allow from all
    </Limit>
    <LimitExcept GET POST OPTIONS>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>

A search for MultiViews in httpd.conf finds only two comment lines, so MultiViews aren't enabled anyplace else. There is no mod_rewrite in the configuration file.

There is an .htaccess file in each student's directory. No MultiViews there, either, but for completeness, here is the one in question:

AuthType Basic
AuthName "Password Required"
Satisfy any
Deny from all
AuthUserFile /etc/httpd/users
AuthGroupFile /etc/httpd/groups
Require user [redacted]
Require group professors

My goal is to change httpd.conf so that the above no longer works and then tell students to do it right.

There was a MultiViews in the above directory section. I removed it and restarted httpd before posting here. I have checked /var/log/messages to be absolutely, positively sure that the HTTP daemon was restarted successfully.

If I copy the contents of the student's public_html directory to a directory under the server root, specifically /var/www/html/2015_02/student/ the picture does not display, so it is something about either that student's directory or the way all the student directories are set up in the configuration above. The test below rules out a problem with that particular directory.

I built a fake student directory, /home/bbrown/public_html/ and placed a jpeg in it. I can display it without the .jpg extension, e.g. http://weblab.spsu.edu/~bbrown/bbrown_quad_175 and the URL remains unchanged, without the extension. Something is wrong with the configuration, possibly in the <Directory /home/*/public_html> section above. This was all after removing MultiViews and restarting, so there is no possibility the image was cached and served from cache.

11
  • Does the student know why this works?
    – MrWhite
    Jan 27, 2015 at 15:39
  • @w3d: No, he doesn't.
    – Bob Brown
    Jan 27, 2015 at 18:33
  • This might be a redirection also; if visiting J3 directly shows a final URL of example.com/path/J3 that suggests MultiViews, while showing a final URL of example.com/path/J3.jpg indicates a redirect or use of mod_rewrite. I'd investigate this using curl --head http://example.com/path/J3 Jan 27, 2015 at 18:53
  • 1
    @w3d: Aha! Please make that an answer so that I can accept it! There is a userdir.conf in conf.d that's implicitly included.
    – Bob Brown
    Jan 27, 2015 at 21:12
  • 1
    Yes, there was an Options Multiviews there, too. I've accepted Stephen's answer, but the real problem was that I had forgotten that the contents of conf.d are included implicitly. Thank you!
    – Bob Brown
    Jan 27, 2015 at 21:23

1 Answer 1

8

This feature of Apache is known as "MultiViews" and it is handled by the content negotiation module:

...if /some/dir has MultiViews enabled, and /some/dir/foo does not exist, then the server reads the directory looking for files named foo.*, and effectively fakes up a type map which names all those files, assigning them the same media types and content-encodings it would have if the client had asked for one of them by name. It then chooses the best match to the client's requirements.

It can be disabled with the configuration Options -MultiViews as described in this question from ServerFault: apache multiviews, how to disable it.

The MultiViews option can appear in the main httpd.conf file, in a .htaccess file, or in files included with an Include directive, such as those in /etc/httpd/conf.d. Just checking the main configuration file is not enough.

7
  • 2
    Note that MultiViews must be explicitly enabled by name, it's not part of the All option - so is never enabled by default. So, if you are in control of the server it might be preferable to remove the directive that enables it in order to "disable" it.
    – MrWhite
    Jan 27, 2015 at 16:57
  • 1
    I thought MultiViews was the problem, but removed if from the config, and the picture still displays. (After restarting HTTPD.)
    – Bob Brown
    Jan 27, 2015 at 17:15
  • 2
    @BobBrown Have you cleared the browser cache? And MultiViews is not enabled in .htaccess?
    – MrWhite
    Jan 27, 2015 at 17:34
  • @w3d: Check. Cache cleared. No Multiviews in .htaccess.
    – Bob Brown
    Jan 27, 2015 at 18:33
  • 1
    @BobBrown: The 500 error is probably because the AllowOverride directive in httpd.conf is blocking MultiViews in .htaccess (so it can't be enabled either).
    – MrWhite
    Jan 27, 2015 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.