Sepeck and I were playing around with the IIS 7 URL Rewrite Module CTP when we noticed that Drupal is completely unusable on IIS 7 with fastcgi.

IIS 7 now has a $_SERVER['REQUEST_URI'] which, contrary to Apache, does not contain the query string and, when rewriting is enabled, does not even contain the entered URL.

This means that all form action attributes are action="/base_dir/index.php" preventing proper form submission. In addition, page caching (keyed on request uri) is broken as well.

IIS 7 + fastcgi gives us the following variables to play with:

Clean URLs ON:

[HTTP_X_ORIGINAL_URL] => /core6/node/add/story
[REQUEST_URI] => /core6/index.php
[QUERY_STRING] => q=node/add/story

Clean URLs OFF:
[HTTP_X_ORIGINAL_URL] => not set.
[REQUEST_URI] => /core6/index.php
[QUERY_STRING] => q=node/add/story

Note that the patch assumes the IIS URL rewrite module for clean URLs.
I really don't like testing $_SERVER['SERVER_SOFTWARE'], but I don't see a way around it.

CommentFileSizeAuthor
#2 298016_request_uri_iis7.patch854 bytesheine
request_uri_iis7.patch1.21 KBheine

Comments

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Status: Active » Needs work

Why not check first for $_SERVER['HTTP_X_ORIGINAL_URL'] then? Instead of server sniffing.

heine’s picture

heine commented
StatusFileSize
new 298016_request_uri_iis7.patch854 bytes

We need to sniff anyway, as when URLs are not rewritten, REQUEST_URI still exists but should not be used for IIS.

heine’s picture

heine commented

It's very easy to add an arbitrary HTTP_X_ORIGINAL_URL header, so we need to take care analysing possible security issues.

ruslany’s picture

ruslany commented

The IIS team is aware of this issue and the hotfix for IIS7 fastcgi module will be provided at the end of August 2008. With the hotfix the REQUEST_URI server variable will include the query string, as well as path info. Also, in case of URL rewriting it will contain the original, un-rewritten URL.

heine’s picture

heine commented
Status: Needs work » Postponed

Thank you.

For those needing it badly: The hotfix is available at http://support.microsoft.com/kb/954946

damien tournoud’s picture

damien tournoud commented

Maybe this should be documented on http://drupal.org/requirements ?

heine’s picture

heine commented
Status: Postponed » Closed (won't fix)

I've added to requirements page.

sepeck’s picture

sepeck commented

I will see about testing with the MS hotfix in the next two weeks

heine’s picture

heine commented

I've tested with the hotfix, and it solves the issue at hand.

ruslany’s picture

ruslany commented

The update for the IIS 7.0 FastCGI module that fixes this issue is now publicly available from Microsoft. You can download the update from here:

http://www.microsoft.com/downloads/results.aspx?pocId=&freetext=954946&DisplayLang=en

With this update the FastCGI module now sets the REQUEST_URI server variable to include query string and path info. Also, if URL rewriting is used on the web server then the REQUEST_URI will contain the originally requested URL, not the rewritten one.

More information about the update is available here: http://ruslany.net/2008/08/update-for-iis-70-fastcgi-module/

sepeck’s picture

sepeck commented

Thanks ruslany. I will update the requirements page and get working on an install doc for it.