Topic: mod_xsendfile doesn't send files outside DocumentRoot

[Jura]

Apache 2.2.16 (Win32) on Win7 x64, mod_xsendfile 0.12

Mod is enabled globally

LoadModule xsendfile_module modules/mod_xsendfile.so
XSendFile on


Virtual server config directives:

<VirtualHost *:80>
DocumentRoot "C:\projects"
ServerName localhost
XSendFilePath "D:\Install"
</VirtualHost>

Everything underneath DocumentRoot works fine, when serving file from D:\Install I'm always getting the following:

[Thu Nov 25 12:21:36 2010] [error] [client 127.0.0.1] (20023)The given path was above the root path: xsendfile: unable to find file: D:\\install\\iso\\myiso.iso

File itself is there and if relocated under DocumentRoot works like a charm

Any clue?

[tdonovan]

Two suggestions:

Use forward slashes instead of backslashes in Apache config files
- i.e. "D:/Install"
It is best to use forward slashes in the X-SENDFILE header, too.

Use the correct case for the actual directory name in both the X-SENDFILE header, and the XSendFilePath directive
- i.e. use D:/Install instead of D:/install if the directory name in Windows is really D:\Install with an upper-case I.

-tom-

[Jura]

@tom

I checked all possible combinations already - backslashes, forward slashes, quotation marks and bare path, exact case for path and lower case - no luck at all. Result is always the same. Only output in error.log changes accordingly .

I also tried to exclude permissions problem - both directories (DocumentRoot and XSendFilePath are configured with the same set, no .htaccess files whatsoever.

BTW, I tried to install mod_xsendfile 0.9 from Apachlounge and it works perfectly with XSendFileAllowAbove On directive but there is an obvious security concern if I'm not able to whitelist particular directories to server files from - that's why I would love to get the latest version to work...