• Bug 9205 has been marked as a duplicate of this bug. ***

This is a low-level "feature" in Apache.

• Bug 11735 has been marked as a duplicate of this bug. ***

See http://httpd.apache.org/docs/2.0/mod/core.html#allowencodedslashes how to fix this. in my opinion, it should be fixed, as I think there is no security issue here in danger by allowing encoded hashes.

When we've upgraded every server to Apache 2, we'll take a peek. :)

(In reply to comment #5)

When we've upgraded every server to Apache 2

Do you mean WMF servers still run Apache 1.3? *shock*

*** Bug 17389 has been marked as a duplicate of this bug. ***

Reopening.

(1) Makes it easier to find when searching to avoid dupes.
(2) This should probably be looked at again. How far along is the transition to Apache 2?

This blog post details five ways to solve this issue: http://www.jampmark.com/web-scripting/5-solutions-to-url-encoded-slashes-problem-in-apache.html

Note four of those ways are "don't encode them that way", and one is to use the configuration option in Apache 2 mentioned above to disable the stupid restriction. :)

Complete Apache 2 use is still pending on completion of the Ubuntu migration -- filing this as bug 17452 so we have it in the dependency tree.

*After* the migration is completed we can go ahead and disable the check. Until then it should remain on so behavior will remain consistent.

Ping

Done.