Bug#909495: apache2-bin: Combination of fastcgi/php-fpm and URL-Rewriting unusable

[Edward Nash <e.nash@dvz-mv.de>]

Package: apache2-bin
Version: 2.4.25-3+deb9u5
Severity: normal

Dear Maintainer,

with the current stable apache2-bin it is not possible to combine URL-shortening
("SEO optimisation") via mod_rewrite and the use of PHP-FPM, e.g. with the
following configuration:

Alias /test /path/to/test

<Directory "/path/to/test">
  Require all granted
  # short URLs without /index.php/
  Options +FollowSymLinks
  RewriteEngine on
  RewriteBase /test/
  RewriteRule ^(.*)$ index.php/$1 [L]

  <FilesMatch "\.php$">
    SetHandler "proxy:unix:/var/run/php/php7.0-fpm-www.sock|fcgi://fpm-www/"
  </FilesMatch>
</Directory>

Calling http://server/test or http://server/test/index.php/pathinfo works, but
http://server/test/pathinfo fails with error:

Got error 'Primary script unknown\n'

This is described e.g. at https://serverfault.com/q/847312 and is a known
bug in Apache 2.4.25, making it impossible to use any applications
which use this common pattern with apache2 + php-fpm under stretch.

Fixes for this were introduced in 2.4.26 and 2.4.27.

Please therefore consider backporting the fixes for the following Apache2
tickets to 2.4.25 for an upcoming maintenance release:
https://bz.apache.org/bugzilla/show_bug.cgi?id=60576
  -> Fix in https://svn.apache.org/viewvc?view=revision&revision=1788445
https://bz.apache.org/bugzilla/show_bug.cgi?id=61202
  -> Fix in https://svn.apache.org/viewvc?view=revision&revision=1800618

-- Package-specific info:

-- System Information:
Debian Release: 9.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-6-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages apache2-bin depends on:
ii  libapr1                  1.5.2-5
ii  libaprutil1              1.5.4-3
ii  libaprutil1-dbd-sqlite3  1.5.4-3
ii  libaprutil1-ldap         1.5.4-3
ii  libc6                    2.24-11+deb9u3
ii  libldap-2.4-2            2.4.44+dfsg-5+deb9u2
ii  liblua5.2-0              5.2.4-1.1+b2
ii  libnghttp2-14            1.18.1-1
ii  libpcre3                 2:8.39-3
ii  libssl1.0.2              1.0.2l-2+deb9u3
ii  libxml2                  2.9.4+dfsg1-2.2+deb9u2
ii  perl                     5.24.1-3+deb9u4
ii  zlib1g                   1:1.2.8.dfsg-5

apache2-bin recommends no packages.

Versions of packages apache2-bin suggests:
pn  apache2-doc                                      <none>
pn  apache2-suexec-pristine | apache2-suexec-custom  <none>
pn  www-browser                                      <none>

Versions of packages apache2 depends on:
ii  apache2-data         2.4.25-3+deb9u5
ii  apache2-utils        2.4.25-3+deb9u5
ii  dpkg                 1.18.25
ii  init-system-helpers  1.48
ii  lsb-base             9.20161125
ii  mime-support         3.60
ii  perl                 5.24.1-3+deb9u4
ii  procps               2:3.3.12-3+deb9u1

Versions of packages apache2 recommends:
ii  ssl-cert  1.0.39

Versions of packages apache2 suggests:
pn  apache2-doc                                      <none>
pn  apache2-suexec-pristine | apache2-suexec-custom  <none>
pn  www-browser                                      <none>

Versions of packages apache2-bin is related to:
ii  apache2      2.4.25-3+deb9u5
ii  apache2-bin  2.4.25-3+deb9u5

-- no debconf information