htaccess rewriting for %253f , %253d ?

[kai920]

In my 404 log (using Apache Handler mod), I see a bunch of requests for URLs with "%253f" and "%253d" in them... I assume these represent "?" and "=" respectively:

/forums/index.php%253ftopic%253d1435.0
/forums/index.php%253ftopic%253d358.msg2075
/forums/index.php%253ftopic%253d376.0

When I track the IP address, they always seem to come from Websense, Inc.

I don't think this would be a malicious bot (correct me if wrong)... but how do I rewrite them in htaccess? I tried this but it doesn't match:

Code Select Expand


RewriteCond %{REQUEST_URI} ^/forums/index.php\%253ftopic\%253d1435.0$
RewriteRule (.*) http://www.mysite.com/forums/index.php?topic=1435.0 [R=301,L]


[Arantor]

They do but only indirectly. Somewhere along the line things have gotten mushed.

Did you turn RewriteEngine On in said .htaccess file, and also, where is it?

[kai920]

Yep, RewriteEngine is on.

I have 2 htaccess files, one in the root www, and one in /forums. The one in forums has been redirecting other /forums URLs correctly so I'm thinking something is not matching in the RewriteRule?

[Arantor]

Is the rule above in the top level (www) file, or in /forums ?

[kai920]

In /forums I believe. Let me check. (Yep, just checked. It's in /forums)

[Arantor]

And is there a RewriteBase in operation? I've found before that having ^/ whilst in a subdirectory has caused me problems with RewriteBase but it's been so long since I've done it I'd have to crack open the archives to find it.

[kai920]

No I don't have RewriteBase... should I add in

RewriteBase /forums

?

[Arantor]

No, leave it as is.

If you're in the forums directory, prune the rule to remove the /forum/ bit, just refer to the path relative to that directory.

[kai920]

Still didn't work .. also remembered to escape the .

Code Select Expand


RewriteCond %{REQUEST_URI} ^index\.php\%253ftopic\%253d1435\.0$



PS. what exactly is "%253f" .. is it UTF8 encoding?

[Arantor]

No, it's URL encoding gone bad. %25 = %, so it would resolve to %3f which is URL encoded ?

[kai920]

You're right, when I hover over the URL it says %3ftopic%3d1435.0

[Arantor]

Hang on... SMF is generating that URL?

[kai920]

No, I see that URL "in" SMF once the Apache Handler mod picks it up in the 404 message.

In the error logs it just shows this without the URL linked..

Error 404 - Not Found (http://site.com/forums/index.php%253ftopic%253d1435.0)

[Arantor]

Weird. So when browsing your forum normally, if you look in the HTML source in the browser you don't see mangled links like that?

Oh and for the RewriteRule, take off the ^ at the start of the rule when you're on a per directory basis.

[kai920]

Nope, normally I don't see any links with these %253f and %253d.

I've only seen it in the Error Log after installing the Apache Error Handler mod.

[Arantor]

Is this still happening for you?

[kai920]

Yeah, I still notice these in the log...

[Arantor]

It would be interesting to find out where these are actually coming from. Is it a search engine that is hitting these links?