When "pl" meant two different things

On 19 August 2026 we added a rule to .htaccess blocking a class of file that should never be served directly to a browser: leftover source-code copies sitting in the web root after an edit — index.php.bak, a stray config.py, anything with a scripting extension where a visitor could fetch the source as plain text instead of running it.

The rule matched on file extension: .php, .py, .rb, .pl, and a dozen others. .pl is Perl. This project has not one line of Perl in it — the rule was precautionary, not a fix for a file that existed.

About a day later, a visitor reported that counter previews were broken. Every one of them, but only in one language.

The other "pl"

stats4u.net picks a language per visitor through Accept-Language negotiation, not a fixed default — a browser set to Polish gets served /pl/ directly, no redirect involved, and English is what the site falls back to when nothing matches. Polish is a common match: enough visitors land there that a day of broken thumbnails was never going to go unnoticed for long.

Every design preview is one small file per style and language: cache/preview/2900.pl.svg. The pattern meant to catch something.pl — a Perl script — also matched 2900.pl followed by .svg: a style number, a language code that happens to be spelled the same as a scripting extension, then the real file type. A dot-pl-dot pattern can't tell those two apart.

Every .pl.svg and .pl.png preview in the gallery started answering 403 Forbidden. Every other language was untouched, because no other language code this site uses collides with an entry on the extension list. Just the one.

What changed

pl came out of the extension list. It still blocks every real script extension this project has a reason to worry about; it no longer blocks a language.

Worth writing down for the reason it happened at all: a list of file extensions and a list of language codes come from two different vocabularies, and nothing stops a two-letter entry from meaning both at once. Before adding to either list on a site with language prefixes in the path, check it against the other one. We didn't, and it took a reader noticing broken thumbnails — not our own monitoring — to catch it.