Apache + samba problem

[Maciej Gasiorowski <debian@byss.pl>]

Hello list.

I've found out interesting thing using apache and samba on my test server.
I'm not sure if it is a new issue but I couldn't find anything similar
on google.

I've configured apache to serve content from a mounted windows share.
Now the best begins. When I add a backslash ("\") mark at the end of url
like
http://localhost/winshare/index.php\
apache displays my PHP code instead of executing it.

Simple strace shows something like that:

stat64("/home/winshare/index.php\\", {st_mode=S_IFREG|0644, st_size=217,
...}) = 0
lstat64("/home", {st_mode=S_IFDIR|S_ISGID|0775, st_size=4096, ...}) = 0
lstat64("/home/winshare", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
open("/home/winshare/.htaccess", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No
such file or directory)
lstat64("/home/winshare/index.php\\", {st_mode=S_IFREG|0644,
st_size=217, ...}) = 0
open("/home/winshare/index.php\\", O_RDONLY|O_LARGEFILE) = 5
select(4, [3], NULL, NULL, {0, 0})      = 0 (Timeout)
write(3, "HTTP/1.1 304 Not Modified\r\nDate:"..., 237) = 237

I guess that lstat or samba itself is stripping "\\" from the file
during name lookup because it doesn't return 404 error. But the
resulting extension (.php\) doesn't match any AddType directive, so
apache is just displaying it in plain text.
I've checked and after adding
AddType application/x-httpd-php .php .php\ .php%5C
code is being executed.

I've tested in on two linux boxes but on single windows share so it
could be some configuration error.
I don't suppose there are a lot of production servers configured in
similar way but it could still be an security issue.

Sorry, if this is a faq.

Best regards
Maciej Gasiorowski