fix(httputils): canonicalize paths when building X-Accel-Redirect URLs

http_xaccel_url() compared the fullpath()-collapsed target file against a
non-canonicalized DOKU_INC and the raw savedir config

fix(httputils): canonicalize paths when building X-Accel-Redirect URLs

http_xaccel_url() compared the fullpath()-collapsed target file against a
non-canonicalized DOKU_INC and the raw savedir config value. The lib/exe entry
points define DOKU_INC as __DIR__.'/../../' and savedir defaults to the relative
'./data', so the in-tree prefix check never matched: nginx installs using
X-Accel-Redirect served in-tree files behind the /_x_accel_redirect/ escape
hatch and returned 404 without extra location config.

Canonicalize DOKU_INC and every configured root with fullpath() before the
prefix comparisons so they match the already-canonicalized file path.

The comparison lost its fullpath() wrapping in b8c2692f7, which replaced the
earlier substr($file, strlen(fullpath(DOKU_INC)) + 1) with a raw DOKU_INC
prefix check.

show more ...

fix(httputils): build a proper internal URL for nginx X-Accel-Redirect

Unlike Apache's mod_xsendfile and lighttpd's X-LIGHTTPD-send-file,
which both accept an absolute file system path and stream th

fix(httputils): build a proper internal URL for nginx X-Accel-Redirect

Unlike Apache's mod_xsendfile and lighttpd's X-LIGHTTPD-send-file,
which both accept an absolute file system path and stream the file
directly, nginx treats X-Accel-Redirect as a URL: it performs an
internal subrequest against the value and resolves it through
`internal` location blocks in its own configuration. The redirect
target therefore must be a request path nginx can map back to a file,
not the file system path itself.

The previous implementation blindly stripped DOKU_INC's length from
the file path, which produced a broken URL whenever a data directory
had been relocated outside the DokuWiki tree.

Route the file through three cases instead: files inside DOKU_INC keep
their path relative to the wiki root; files in a relocated mediadir,
mediaolddir, cachedir or savedir are mapped back to their default URL
below data/; everything else falls through an opt-in /_x_accel_redirect/
prefix.

Path segments are URL-encoded so filenames with spaces or other
special characters resolve (fixes another potential bug in the previous
implementation).

Nginx configuration:

For the default layout no extra configuration is needed - files keep
their path relative to the wiki root and the regular wiki location
already serves them. For relocated data directories admins must add an
`internal` location below the wiki's URL space pointing at the actual
file system path, e.g.:

location /data/media/ { internal; alias /srv/dokuwiki-media/; }

For the /_x_accel_redirect/ fallback (used when a plugin serves files
from outside the wiki and its data directories), admins opt in by
adding:

location /_x_accel_redirect/ { internal; alias /; }

When the wiki is installed under a sub path, prefix both locations
accordingly (e.g. /wiki/data/media/ and /wiki/_x_accel_redirect/).

fixes: #2895

show more ...