So I was trying to find some content on my site and did a search for .india and I discovered this bug.
I managed to replicate it on drupal gardens:
http://sampler.drupalgardens.com/search/node/.india gives the following Apache error.

Forbidden

You don't have permission to access /search/node/.india on this server.

Comments

naxoc’s picture

Version: 7.10 » 8.x-dev

This is also an issue in D8.

naxoc’s picture

Oh, and it is only an issue with clean urls on.

naxoc’s picture

Status: Active » Needs review
StatusFileSize
new3.62 KB

This issue may not seem like a big deal, but just this week as I was doing a lot of searching for .vimrc files (I am trying to switch to Vim) I had the problem a number of times, so I ended up writing the attached patch.

The reason a 403 will always be sent when clean urls is on is that in Drupal .htaccess there is a rewrite rule that blocks access to any directory starting with a '.'. This is a feature I think we should definitely keep, so the only way to make it possible for Drupal to allow searches starting with '.' is to url-escape an initial period.

The patch introduces a helper function - not sure if that is the way to go, so all input is very welcome. I was also quite unsure what to name the function. There was already a test written for searching numbers, so I just added a number starting with a decimal to a list of things to test for in that function and set clean urls to true. Clean urls should be on in the number test anyway in my opinion.

naxoc’s picture

Tagging

naxoc’s picture

#3: dot-search-1421560-3.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, dot-search-1421560-3.patch, failed testing.

cweagans’s picture

naxoc’s picture

Status: Needs work » Needs review
StatusFileSize
new3.7 KB

This is still i (small) feature I would love to see in Drupal. All the other cool kids have it!

Here is a reroll.

jacobsanford’s picture

StatusFileSize
new3.58 KB

Re-rolled!

jhodgdon’s picture

Status: Needs review » Closed (duplicate)

This is essentially the same problem as #890058: Searching for ../../admin takes me to the admin page but with a different Apache configuration.

We are addressing this on
#894486: Use the query string for search keys rather than appending them to the URL