id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
22920	PHP being included in generated Multisite web.config file	stevegrunwell	markjaquith	"When enabling a Multisite network on a subdirectory installation of 3.5 this morning on a Windows server (Windows Server 2008r2, IIS 7, PHP 5.3.18, MySQL 5.1) the web.config file it generated on the network setup screen had what appears to be unescaped PHP (around the ""WordPress Rules for Files"" rule), which broke the XML file.

Generated XML:
{{{
<?xml version=""1.0"" encoding=""UTF-8""?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name=""WordPress Rule 1"" stopProcessing=""true"">
                    <match url=""^index\.php$"" ignoreCase=""false"" />
                    <action type=""None"" />
                </rule>';
				if ( is_multisite() && get_site_option( 'ms_files_rewriting' ) ) {
					 .= '
                <rule name=""WordPress Rule for Files"" stopProcessing=""true"">
                    <match url=""^blog/([_0-9a-zA-Z-]+/)?files/(.+)"" ignoreCase=""false"" />
                    <action type=""Rewrite"" url=""blog/C:\inetpub\wwwroot\wordpress\blog/wp-includes/ms-files.php?file={R:1}"" appendQueryString=""false"" />
                </rule>';
                }
                 .= '
                <rule name=""WordPress Rule 2"" stopProcessing=""true"">
                    <match url=""^blog/([_0-9a-zA-Z-]+/)?wp-admin$"" ignoreCase=""false"" />
                    <action type=""Redirect"" url=""{R:1}wp-admin/"" redirectType=""Permanent"" />
                </rule>
                <rule name=""WordPress Rule 3"" stopProcessing=""true"">
                    <match url=""^"" ignoreCase=""false"" />
                    <conditions logicalGrouping=""MatchAny"">
                        <add input=""{REQUEST_FILENAME}"" matchType=""IsFile"" ignoreCase=""false"" />
                        <add input=""{REQUEST_FILENAME}"" matchType=""IsDirectory"" ignoreCase=""false"" />
                    </conditions>
                    <action type=""None"" />
                </rule>
                <rule name=""WordPress Rule 4"" stopProcessing=""true"">
                    <match url=""^blog/([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*)"" ignoreCase=""false"" />
                    <action type=""Rewrite"" url=""blog/C:\inetpub\wwwroot\wordpress\blog/{R:1}"" />
                </rule>
                <rule name=""WordPress Rule 5"" stopProcessing=""true"">
                    <match url=""^blog/([_0-9a-zA-Z-]+/)?([_0-9a-zA-Z-]+/)?(.*\.php)$"" ignoreCase=""false"" />
                    <action type=""Rewrite"" url=""blog/C:\inetpub\wwwroot\wordpress\blog/{R:2}"" />
                </rule>
                <rule name=""WordPress Rule 6"" stopProcessing=""true"">
                    <match url=""."" ignoreCase=""false"" />
                    <action type=""Rewrite"" url=""index.php"" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>
}}}

The same broken XML file can be accessed by visiting the ""Network Setup"" page from the Network Admin panel."	defect (bug)	closed	normal	3.5.1	Multisite	3.5	major	fixed	needs-patch	info@…