WonderCMS on lighttpd (configuration)

[Claudiu]

A great job with this WonderCMS. It is lightning fast.
I've also added it to an custom firmware router and runs superbly. It uses lighttpd to reduce de memory usage.
Up to now I can say that the smallest CMS runs superbly on one of the fastest web servers!

However there are some issues when rewriting.
Can anybody help me with a correct configuration for lighttpd (e.g. .htaccess migration)?

[turboblack]

A great job with this WonderCMS. It is lightning fast.
I've also added it to an custom firmware router and runs superbly. It uses lighttpd to reduce de memory usage.
Up to now I can say that the smallest CMS runs superbly on one of the fastest web servers!

However there are some issues when rewriting.
Can anybody help me with a correct configuration for lighttpd (e.g. .htaccess migration)?

is it you are looking for?
http://wondercms.com/forum/viewtopic.php?f=20&t=677

[Claudiu]

Thanks turboblack. The link you provided had the apache .htaccess data I was talking about.

I spent some time searching on the internet and found a fix for lighttpd that would make WonderCMS work.
I added to the lighttpd config file the following lines:

Code: Select all

url.rewrite-once = (
        "^/([^.?]*)$" => "/index.php?page=$1",
)

This seems to be the equivalent for the apache's:

Code: Select all

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1#%{REQUEST_URI} ([^#]*)#(.*)\1$
RewriteRule ^([^\.]+)$ %2?page=$1 [QSA,L]

If there is someone with experience in Rewrite command in lighttpd, please correct the config if required. For now, all seems OK!

I need to say also that the WonderCMS 0.6 vulnerability fix does not work for lighttpd. In order to work, there is still necessary to have a lighttpd .htaccess equivalent for:

Code: Select all

RewriteCond %{THE_REQUEST} password($|\ |\?) [NC]
RewriteRule .* - [F]

If anyone can contribute to this, I would be most grateful.
For now, we should wait for a newer version.

[Claudiu]

OK. I succeeded in protecting the password file from the WonderCMS hosted on a lighttpd server.

So the temporary fix for the WonderCMS 0.6 BETA vulnerability is to add to the lighttpd config file the following code:

Code: Select all

$HTTP["querystring"] == "page=password" {
    url.access-deny = ("")
}

This restricts access to the password file and behaves like the apache .htaccess lines:

Code: Select all

RewriteCond %{THE_REQUEST} password($|\ |\?) [NC]
RewriteRule .* - [F]