Ubuntu, Apache, PHP, Javascript (something is not working)...

[mvbighead]

I am not exactly sure how to word this, but figured someone here might have an idea as to what the problem is.

Running Ubuntu Server as a web server with MySQL for Open Audit.

Almost everything is fine. The Mysql DB is working as expected, and the Apache is coming up with the site, and configured the DB as expected.

My only issue is it seems Javascripts are not running. There are numerous items on the front page that search the DB to report things such as Systems audited in the last 7 days, etc. It runs a query to pull this info from the MySQL backend. Problem is, not of those scripts actually run, so the progress indicators just keep spinning and spinning, but no errors are reported.

Any advice is appreciated. If you need more detail, please let me know.

 

[mvbighead]

As an update... I am 99% certain that this is a problem with Javascripts. Disabled javascripts in FF, and ran the working site (on a different server), and it acts exactly the same way as the non-working sites. Any idea as to why this server would not allow javascripts to run?

 

[Platypus]

Javascript is handled on the client side but from the sounds of it you're trying to use it server side. This is possible I believe with the proper apache module (I believe there's a project called mod_js but it's been awhile). Your title says php in it but I didn't see you mention it in your post.. something that queries your database to display info on the page should probably be done with php.. I guess I'm a bit confused as to what you're trying to do with Javascript in particular.

 

[mvbighead]

Thanks for the response. The openaudit system is, for the most part, entirely configured out of the box. As far as I understand it, it should just work.

It looks like the stuff is client side, as it should simply show some information on the site based on what the scripts are doing. Problem is, they aren't doing anything. The best I can figure is I somehow am unable to get to the scripts because I am not properly being directed there. For the time being, I have chmod'd the entire directory to 777 just to make sure I am allowed to see everything.

Any ideas as to why my browser can't get to the scripts?

EDIT:

As to the PHP, it is the language base of the site. Most of the code is in PHP, and that all seems to be working, as far as I can tell.

 

[Platypus]

Thanks for the response. The openaudit system is, for the most part, entirely configured out of the box. As far as I understand it, it should just work.

It looks like the stuff is client side, as it should simply show some information on the site based on what the scripts are doing. Problem is, they aren't doing anything. The best I can figure is I somehow am unable to get to the scripts because I am not properly being directed there. For the time being, I have chmod'd the entire directory to 777 just to make sure I am allowed to see everything.

Any ideas as to why my browser can't get to the scripts?

EDIT:

As to the PHP, it is the language base of the site. Most of the code is in PHP, and that all seems to be working, as far as I can tell.

I'm not all the savvy with web development, but are you sure this product is using javascript to make database calls?

Are you able to access the .js files directly based on URL?

 

[Ken g6]

Usually when Javascript fails to run for me, there's a bug in it. Have you tried loading the page with FF and FireBug, to check for errors?

 

[Platypus]

OP, I downloaded the app just to look at it:

What are the permissions like on the javascript folder? Are you able to navigate to http://yourpage/javascript/PopupMenu.js?

You mentioned chmoding the dir to 777 but was that recursive? (still a bad idea but for troubleshooting it's totally ok). Perhaps the javascript directory isn't readable.

 

[mvbighead]

OP, I downloaded the app just to look at it:

What are the permissions like on the javascript folder? Are you able to navigate to http://yourpage/javascript/PopupMenu.js?

You mentioned chmoding the dir to 777 but was that recursive? (still a bad idea but for troubleshooting it's totally ok). Perhaps the javascript directory isn't readable.

I did a recursive 777 to the entire web folder for that app. I tried the URL test you suggested, and get a page not found. So, it seems pretty clear it isn't able to read the folder. Aside from CHMOD/CHOWN-ing the files, not sure why it wouldn't be readable. Checking the permissions on everything and they're all wide open (very bad, but should at least allow this stuff to work). Why would the directory not be readable?

 

[Platypus]

I did a recursive 777 to the entire web folder for that app. I tried the URL test you suggested, and get a page not found. So, it seems pretty clear it isn't able to read the folder. Aside from CHMOD/CHOWN-ing the files, not sure why it wouldn't be readable. Checking the permissions on everything and they're all wide open (very bad, but should at least allow this stuff to work). Why would the directory not be readable?

Are you able to get to the javascript folder by itself?

Can you print out what your DocumentRoot variable is set to in httpd.conf for me? Also, the absolute path to the openaudit software?

 

[mvbighead]

Are you able to get to the javascript folder by itself?

Can you print out what your DocumentRoot variable is set to in httpd.conf for me? Also, the absolute path to the openaudit software?

I can't get to the path from the browser, but can see it fine via the command line. All the .js scripts are there.

I had set the DocumentRoot variable to "/var/www/html"

The path for the openaudit files is /var/www/html/openaudit (and obviously the javascript folder is in /var/www/html/openaudit/javascript).

 

[Platypus]

I can't get to the path from the browser, but can see it fine via the command line. All the .js scripts are there.

I had set the DocumentRoot variable to "/var/www/html"

The path for the openaudit files is /var/www/html/openaudit (and obviously the javascript folder is in /var/www/html/openaudit/javascript).

So you're going to:

http://yoursite.com/openaudit

To see your openaudit install, is that correct?

But http://yoursite.com/openaudit/javascript isn't working?

Let's see the following:

#> ls -al /var/www/html/openaudit
#> ls -al /var/www/html/openaudit/javascript

 

[mvbighead]

So you're going to:

http://yoursite.com/openaudit

To see your openaudit install, is that correct?

But http://yoursite.com/openaudit/javascript isn't working?

Let's see the following:

#> ls -al /var/www/html/openaudit
#> ls -al /var/www/html/openaudit/javascript

I'm actually going to http://openaudit/ (just used a DNS pointer for simplification of site access).


All of the files look like this in the /var/www/html/openaudit directory:
-rwxrwxrwx 1 www-data www-data 5181 2010-02-18 14:57 software_register_edit_comments.php

And the same in the /var/www/html/openaudit/javascript directory:

-rwxrwxrwx 1 www-data www-data 36699 2010-02-18 14:56 admin_config.js
-rwxrwxrwx 1 www-data www-data 12381 2010-02-18 14:56 ajax.js
-rwxrwxrwx 1 www-data www-data 3983 2010-02-18 14:56 async_alerts.js
-rwxrwxrwx 1 www-data www-data 6226 2010-02-18 14:56 audit_cmd.js
-rwxrwxrwx 1 www-data www-data 21123 2010-02-18 14:56 audit_config.js
-rwxrwxrwx 1 www-data www-data 10986 2010-02-18 14:56 audit_manage.js
-rwxrwxrwx 1 www-data www-data 5197 2010-02-18 14:56 audit_mysql_query.js
-rwxrwxrwx 1 www-data www-data 5181 2010-02-18 14:56 audit_sched.js
-rwxrwxrwx 1 www-data www-data 1938 2010-02-18 14:56 include.js
drwxrwxrwx 2 www-data www-data 4096 2010-03-03 10:56 jquery
-rwxrwxrwx 1 www-data www-data 10042 2010-02-18 14:56 list-system.js
-rwxrwxrwx 1 www-data www-data 7056 2010-02-18 14:56 mysql_query.js
-rwxrwxrwx 1 www-data www-data 6387 2010-02-18 14:56 PopupMenu.js

As an FYI, I CHOWN'd the directory so the Apache user (www-data) held the rights to everything. Though I may have screwed something up there...

 

[Platypus]

I'm actually going to http://openaudit/ (just used a DNS pointer for simplification of site access).


All of the files look like this in the /var/www/html/openaudit directory:
-rwxrwxrwx 1 www-data www-data 5181 2010-02-18 14:57 software_register_edit_comments.php

And the same in the /var/www/html/openaudit/javascript directory:

-rwxrwxrwx 1 www-data www-data 36699 2010-02-18 14:56 admin_config.js
-rwxrwxrwx 1 www-data www-data 12381 2010-02-18 14:56 ajax.js
-rwxrwxrwx 1 www-data www-data 3983 2010-02-18 14:56 async_alerts.js
-rwxrwxrwx 1 www-data www-data 6226 2010-02-18 14:56 audit_cmd.js
-rwxrwxrwx 1 www-data www-data 21123 2010-02-18 14:56 audit_config.js
-rwxrwxrwx 1 www-data www-data 10986 2010-02-18 14:56 audit_manage.js
-rwxrwxrwx 1 www-data www-data 5197 2010-02-18 14:56 audit_mysql_query.js
-rwxrwxrwx 1 www-data www-data 5181 2010-02-18 14:56 audit_sched.js
-rwxrwxrwx 1 www-data www-data 1938 2010-02-18 14:56 include.js
drwxrwxrwx 2 www-data www-data 4096 2010-03-03 10:56 jquery
-rwxrwxrwx 1 www-data www-data 10042 2010-02-18 14:56 list-system.js
-rwxrwxrwx 1 www-data www-data 7056 2010-02-18 14:56 mysql_query.js
-rwxrwxrwx 1 www-data www-data 6387 2010-02-18 14:56 PopupMenu.js

As an FYI, I CHOWN'd the directory so the Apache user (www-data) held the rights to everything. Though I may have screwed something up there...

For grins, try changing your DocumentRoot to /var/www/html/openaudit and bounce apache. I am betting your DNS trick is fucking up the ability to hit the subfolders.

 

[mvbighead]

For grins, try changing your DocumentRoot to /var/www/html/openaudit and bounce apache. I am betting your DNS trick is fucking up the ability to hit the subfolders.

Just tried... no dice.

Just as an FYI, I do have this running on a Red Hat Enterprise Server box as http://openaudit which does work fine, but I cannot seem to find whatever setting is allowing this to work on the new server. Hope that helps.

 

[mvbighead]

Eureka! At least a partial fix was found:

Alias /javascript "/var/www/html/openaudit/javascript"
<Directory "/var/www/html/openaudiit/javascript">
Options Indexes
AllowOverride None
Order allow,deny
Allow from all
</Directory>

Any reason why I would have to do this for subdirectories?

 

[Platypus]

Eureka! At least a partial fix was found:

Alias /javascript "/var/www/html/openaudit/javascript"
<Directory "/var/www/html/openaudiit/javascript">
Options Indexes
AllowOverride None
Order allow,deny
Allow from all
</Directory>

Any reason why I would have to do this for subdirectories?

Interesting.. nah it should have been able to index it properly. I can see it getting confused if you used a DNS alias because it will try to reference where it came from and that is not the right path. They've also changed apache recently so it's possible that its some new thing. Glad you got it working.

 

[mvbighead]

Interesting.. nah it should have been able to index it properly. I can see it getting confused if you used a DNS alias because it will try to reference where it came from and that is not the right path. They've also changed apache recently so it's possible that its some new thing. Glad you got it working.

I really appreciate your help. I am curious as to whether I may have something still not right, as I can't imagine having to create an alias for each and every subdirectory for any site that gets put on this box... but perhaps it was something done intentionally within Apache?

 

[Platypus]

I really appreciate your help. I am curious as to whether I may have something still not right, as I can't imagine having to create an alias for each and every subdirectory for any site that gets put on this box... but perhaps it was something done intentionally within Apache?

No worries, glad it was useful. Are you using apache2.2 by chance? I will download the source later and look into it. I know there is a pretty drastic difference in 2.1 to 2.2 that changed a lot of fundamental things. This could be part of it, or we could both just be doing something stupid. It's hard to tell without seeing the box directly.

I can see it giving you a 403 forbidden if you tried to hit the folder directly AND you didn't have an index.html, but accessing that .js directly should have definitely worked. That part is a bit confusing to me without getting on the box to see the configs myself. It's probably something very simple. I would check the DirectoryIndex and make sure it's set right as well.

 

[mvbighead]

Yep, using Apache/2.2.12.

Still tinkering to see if there is an easier way. I can't imagine doing this for 10 or 20 subdirectories to make it work.

Some tinkering has helped me find that the one line that made this work was:

Alias /javascript "/var/www/html/openaudit/javascript"

Everything else had no impact.

I have been trying:

Alias /* /var/www/html/openaudit/*

Which did not work. Still looking though.

 

[Platypus]

Yep, using Apache/2.2.12.

Still tinkering to see if there is an easier way. I can't imagine doing this for 10 or 20 subdirectories to make it work.

Some tinkering has helped me find that the one line that made this work was:

Alias /javascript "/var/www/html/openaudit/javascript"

Everything else had no impact.

I have been trying:

Alias /* /var/www/html/openaudit/*

Which did not work. Still looking though.

I think that alias is helping it work because of that DNS pointer you had. Your page is trying to do a /javascript/script.js but apache doesn't know how to handle going into the directory.. I would think that having your DocumentRoot directly pointing to openaudit would take care of it. I would look into setting up a VirtualHost perhaps, that seems to be the way apache2.2 is going towards. There is also a global parameter for directory index you might look into.

But, as I said, trying to hit yoursite.com/javascript alone SHOULD have failed (unless you have an index.html), but accessing a specific file within that directory should not have failed, so there's something strange going on.

 

[mvbighead]

I finally figured this sucker out.

I put the alias in the apache2.conf file, outside of the virtual host, and was warned that it would be overridden by code elsewhere. Low and behold:

/etc/apache2/conf.d/javascript-common.conf contains:

Alias /javascript /usr/share/javascript/
<Directory "/usr/share/javascript/">
Options FollowSymLinks MultiViews
</Directory>

Which, this hole flipping time, has been taking the place of /var/www/html/openaudit/javascript, and rendering the site's own javascript subdirectory irrelevant. Adding the alias within the Virtual host settings did not provide me with this error. I was just screwing around seeing what would happen if I aliased the www/html directory, and when I aliased /javascript in the main config portion, it pointed me to the problem.

For now, I have commented out the code in the /etc/apache2/conf.d/javascript-common.conf, and now everything works like a champ.

 

[Platypus]

I finally figured this sucker out.

I put the alias in the apache2.conf file, outside of the virtual host, and was warned that it would be overridden by code elsewhere. Low and behold:

/etc/apache2/conf.d/javascript-common.conf contains:

Alias /javascript /usr/share/javascript/
<Directory "/usr/share/javascript/">
Options FollowSymLinks MultiViews
</Directory>

Which, this hole flipping time, has been taking the place of /var/www/html/openaudit/javascript, and rendering the site's own javascript subdirectory irrelevant. Adding the alias within the Virtual host settings did not provide me with this error. I was just screwing around seeing what would happen if I aliased the www/html directory, and when I aliased /javascript in the main config portion, it pointed me to the problem.

For now, I have commented out the code in the /etc/apache2/conf.d/javascript-common.conf, and now everything works like a champ.

Ah yeah, glad you found it! I hate that they changed the way apache has always worked on us

 

[DannyBoy]

Sorry to bump an old thread but my 6.0.8 config of Debian on one of my boxes recently showed up with the recent addition of a javascript-common.conf for apache directing to /usr/share/javascript

Upon inspection most of it is the standard library but without having looked into it further there seem to be irregularities with certain observer pattern based methods that appear to be potentially exploitable by malicious code?

Is this common library utilised by something in particular that needs to exec stuff through something I'm unaware of / am I just being paranoid or should I be concerned?

I could and will happily invest and investigate the time necessary to check for myself but would appreciate any time saving opinions / knowledge I'm lacking here!

Thanks,
-D