The Joomla! Forum ™

RULE_0_START:
    # get the document root
    map path into SCRATCH:DOCROOT from /subfolder/
    # initialize our variables
    set SCRATCH:ORIG_URL = %{URL}
    set SCRATCH:REQUEST_URI = %{URL}

    # see if theres any queries in our URL
    match URL into $ with ^(.*)\?(.*)$
    if matched then
    set SCRATCH:REQUEST_URI = $1
    set SCRATCH:QUERY_STRING = $2
    endif
    RULE_0_END:

    RULE_1_START:
    # prepare to search for file, rewrite if its not found
    set SCRATCH:REQUEST_FILENAME = %{SCRATCH:DOCROOT}
    set SCRATCH:REQUEST_FILENAME . %{SCRATCH:REQUEST_URI}

    # check to see if the file requested is an actual file or
    # a directory with possibly an index.  don‚Äôt rewrite if so
    look for file at %{SCRATCH:REQUEST_FILENAME}
    if not exists then
    look for dir at %{SCRATCH:REQUEST_FILENAME}
    if not exists then
    set URL = /subfolder/index.php?q=%{SCRATCH:REQUEST_URI}
    goto QSA_RULE_START
    endif
    endif

    # if we made it here then its a file or dir and no rewrite
    goto END
    RULE_1_END:

    QSA_RULE_START:
    # append the query string if there was one originally
    # the same as [QSA,L] for apache
    match SCRATCH:ORIG_URL into % with \?(.*)$
    if matched then
    set URL = %{URL}&%{SCRATCH:QUERY_STRING}
    endif
    goto END
    QSA_RULE_END:

########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]
#
########## End - Rewrite rules to block out some common exploits

RULE_0_START:
match URL into $ with ^/(.*)$
if not matched then goto RULE_0_END
# RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
set SCRATCH:COND = %{QUERY_STRING}
match SCRATCH:COND into % with mosConfig_[a-zA-Z_]{1,21}(=|\%3D)
if matched then goto RULE_0_CODE_START
# RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
set SCRATCH:COND = %{QUERY_STRING}
match SCRATCH:COND into % with base64_encode.*\(.*\)
if matched then goto RULE_0_CODE_START
# RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
set SCRATCH:COND = %{QUERY_STRING}
insensitive match SCRATCH:COND into % with (\<|%3C).*script.*(\>|%3E)
if matched then goto RULE_0_CODE_START
# RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
set SCRATCH:COND = %{QUERY_STRING}
match SCRATCH:COND into % with GLOBALS(=|\[|\%[0-9A-Z]{0,2})
if matched then goto RULE_0_CODE_START
# RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
set SCRATCH:COND = %{QUERY_STRING}
match SCRATCH:COND into % with _REQUEST(=|\[|\%[0-9A-Z]{0,2})
if not matched then goto RULE_0_END
RULE_0_CODE_START:
# Second half of: RewriteRule ^/(.*)$ index.php [F,L]
set URL = index.php
# This rule has [F]
set RESPONSE = 403
set BODY = Access to this page is denied
# Implicit [L] when converting
goto END
# This rule has [L]
goto END
RULE_0_END:

Unknown variable expansion: QUERY_STRING