[wp-trac] [WordPress Trac] #10743: WP rewrite rule bug with & in url path

[WordPress Trac]

#10743: WP rewrite rule bug with & in url path
--------------------------+-------------------------------------------------
 Reporter:  stephdau      |       Owner:  ryan       
     Type:  defect (bug)  |      Status:  new        
 Priority:  normal        |   Milestone:  2.9        
Component:  Permalinks    |     Version:             
 Severity:  normal        |    Keywords:  needs-patch
--------------------------+-------------------------------------------------

Comment(by stephdau):

 So, a bit of context: we found the above issue when the msn bot got stuck
 in an infinite loop on an install because of a bad link from somwhere that
 ended up being sent to the server as "&nbsp/blah" instead of "/blah".

 Having the & anywhere else in the url does not create an issue, only when
 the 1st character after the root of the wp install.

  * EG: gave a 404, as expected: http://my.host/my/path/to/wp/nbsp&/test

  * EG: just loaded the top page: http://my.host/my/path/to/wp/&nbsp/test

 So in my local install, I fixed it with the following rule, which simply
 redirects offending url to the same one without the ampersand, therefore
 giving the proper wp 404 response:
 {{{
 RewriteRule ^&(.*)$ $1 [R=301,L]
 }}}

 As in:
 {{{
 # BEGIN WordPress
 <IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteBase /~epsi/wptrunk/
 RewriteRule ^&(.*)$ $1 [R=301,L]
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteRule . /~epsi/wptrunk/index.php [L]
 </IfModule>
 # END WordPress
 }}}

 See attached patch for suggested wp-includes/rewrite.php fix.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/10743#comment:2>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software