However, I started getting into trouble when I tried to setup WordPress for both Mandrina and my blog (ed: blogs? Abigail!). The GoDaddy “Hosting Connection” application will allow you to install a set of applications automatically — setup a database and everything. Unfortunately, it will only install for the primary domain for the account — which I set to be something nonexistent. So I needed to customize to go through and reset all paths and domain references by hand, because my blog is not, in fact located at “http://www.some-random-name-23123-that-no-one-likes-123123.com/office-monkey”. I had a bit of problems originally, but I eventually got it straightened out — the biggest trick was in just importing my old MySQL databases, and making only the necessary modifications (directory on disk). That part was easy, and all posts and comments came along for free!

I still have to work out enabling Plugins, but that is likewise minor. There was nothing (aside from Akismet Anti-Spam) that I HAD to have).

The one thing I really wanted to get working, though, was Permalinks. The pretty post names you see as the link behind the title for a particular post.

http://www.office-monkey.com/2008/11/02/to-pick-a-title/

instead of

http://www.office-monkey.com/?p=23

(Different posts, I was lazy.)

IIS doesn’t have RewriteRules built in as Apache does, so where WordPress defaults to writing a .htaccess file on the LAMP stack, it just doesn’t work on PHP/FastCGI on IIS7. However, I came across a mechanism whereby it could work, making use of a custom 404 error handler.

This is where it got tricky for a minute — the sample I was able to find worked for a single domain. However, I needed a single shared 404-processing.php file to handle requests for multiple subdomains. However, I got creative, and figured it out — which made

http://www.office-monkey.com/2008/11/02/to-pick-a-title/

possible instead of the uglier

http://www.office-monkey.com/index.php/2008/11/02/to-pick-a-title/

Interesting thing, happened, though. I went through, and got all the post links working, category links, everything. No problem whatsoever. However, the homepage (http://www.office-monkey.com aka http://www.office-monkey.com/index.php) would not work. It would display a themed page, with no meaningful content. After an embarassing amount of time spelunking in the WordPress PHP source code, I discovered that the “Page.php” file was being processed, rather than the more appropriately named “index.php” file.

It worked when the permalink format was:
/index.php/%yy%/%mm%/%dd%/title
but not when:
/%yy%/%mm%/%dd%/title

My initial guess was that my 404-redirect hack was causing problems, but I was able to quickly establish that it wasn’t being called at all. The one interesting thing I found was that regardless of the permalink format, both scripts were trying to load “/office-monkey/index.php”, where /office-monkey is the subdirectory holding this site’s main content.

I poked around for a long time, then came across a Microsoft KB article — http://support.microsoft.com/kb/954946, alluding to an undescribed problem in how IIS7′s FastCGI implementation could possibly misset $_SERVER['REQUEST_URI'], leading to problems with, gasp, WordPress! I emailed GoDaddy for assistance, asking if the hotfix for the issue had been installed. They asked a few boilerplate questions, then escalated it.

I came up with a minimal repro:
< ?php
echo $_SERVER['REQUEST_URI'];
?>

I had a friend (hi, Jonathan!) run it on a similar configuration on a LAMP stack.
His results?
/request.php
My result?
/office-monkey/request.php

It turned out that the first type of permalinks (including /index.php/ worked only because WordPress handled them differently. They shouldn’t have. The pretty permalinks, on the other hand, tried to match “/office-monkey/index.php” where they were coded to match “/index.php” — since that first default match didn’t apply, a later match for a random page (which didn’t exist) was triggered, and page “/office-monkey/index.php” was loaded.

IIt all came down to $_SERVER['REQUEST_URI']. I added that information to my support request. I tracked down an individual on the IIS team who blogged about the KB article, and he helped me verify that the issue I was seeing with REQUEST_URI was the one fixed by the FastCGI fix (http://ruslany.net/2008/08/update-for-iis-70-fastcgi-module/). My short term fix was to dump the matching Permalink rule (I don’t use WordPress pages anyway).

Meanwhile, I got a response from GoDaddy, which I’ll summarize:
1) We can’t tell you what patches we have installed or when we install them, but we install patches on a regular schedule, and criticl patches as needed.
2) You’ll have to rewrite every script you’re using to edit $_SERVER['REQUEST_URI'] to exclude that leading directory.

I was a bit flabbergasted as to their resolution, and the lack of actual information it provided. So I emailed them back:

Thank you for the update. Unfortunately, some additional information renders your comments less useful than they could otherwise.

I independently verified the intended purpose of the Microsoft Hotfix corresponding to MS KB 954946. You can see the thread here: http://ruslany.net/2008/08/update-for-iis-70-fastcgi-module . As you can see, a Microsoft employee working on IIS verified the cause of the issue I see regarding REQUEST_URI when accessed via FastCGI+PHP, as well as that the hotfix for the KB article would fix the issue.

As far as I have been able to establish the hotfix in question has not been published as an update, but has been out for almost three months. While I can understand your reluctance to publish the current patch level on any servers, as it would serve as an invitation to hackers of all stripes and skill levels, I cannot ascertain whether GoDaddy’s server plans include ever installing this hot fix.

This issue will affect anyone who is running PHP scripts on IIS when dealing with either multiple domains or subdomains. It is a known issue with PHP/FastCGI on IIS7, and would be time-consuming, painful, and incompatible to fix at the source level. I will need to customize my fix for each of several domains, and will need to spend substantial time I don’t have in review in order to assure I cover every entrypoint. I’m certain that I will not be the only person who will or has been affected by this, and given the existence of a fix for the issue, I am surprised and disappointed that I can’t get any confirmation on attention to repair what is in effect a defective server component.

I would like to ensure that I understand the position you are putting forward:
- GoDaddy will not publish their patching policies beyond asserting that updates are applied regularly and critical patches are applied as needed.
- GoDaddy will neither confirm nor deny their intention of ever installing a server hotfix that decreases the value of their shared hosting on IIS7.
- GoDaddy would prefer that individuals personally customize applications that are installable from the HostingConnection/Metropolis site at the source level rather than installing a fix from a major software company.

I had heard good things from several people regarding hosting at GoDaddy, so I’m hoping I’m misunderstanding the intended solution. If this hot fix will be included the next time a set of patches are applied, I can certainly come up with a workaround for the time being. If in order to maintain system security of a hosted application I need to customize it at every patch, I find myself not finding myself in complete agreement with the praise I have heard.

I hope I’m wrong.

Now, my question to anyone actually read this far — was I too mean to the poor support technician?