Skip to content

[6.x] Fix malformed URLs with duplicate leading slashes resolving to home page#14982

Open
lazerg wants to merge 1 commit into
statamic:6.xfrom
lazerg:fix/issue-14980-duplicate-leading-slashes
Open

[6.x] Fix malformed URLs with duplicate leading slashes resolving to home page#14982
lazerg wants to merge 1 commit into
statamic:6.xfrom
lazerg:fix/issue-14980-duplicate-leading-slashes

Conversation

@lazerg

@lazerg lazerg commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

URLs with duplicate leading slashes (e.g., ////url-does-not-exist) were incorrectly resolving to the home page instead of returning 404. This was caused by parse_url() interpreting strings like //unknown as protocol-relative URLs, causing the path to default to /.

The fix normalizes duplicate leading slashes to a single slash before URL parsing in two places:

  1. Path::tidy() - normalizes leading slashes in path strings
  2. URL::makeRelative() - normalizes before parse_url() to prevent protocol-relative URL interpretation

Fixes #14980

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Data::findByRequestUrl can resolve malformed CGI REQUEST_URI with multiple leading slashes to the home page

1 participant