Bug 16922 - Add RewriteRule to apache-shared-intranet for dev package installs
Summary: Add RewriteRule to apache-shared-intranet for dev package installs
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Marcel de Rooy
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-14 12:00 UTC by Marcel de Rooy
Modified: 2020-11-30 21:49 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.05, 19.05.10, 18.11.16


Attachments
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs (2.48 KB, patch)
2016-07-15 06:50 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs (2.52 KB, patch)
2020-03-09 10:13 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs (2.59 KB, patch)
2020-03-20 11:32 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2016-07-14 12:00:05 UTC

    
Comment 1 Marcel de Rooy 2016-07-15 06:50:02 UTC
Created attachment 53410 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.
Comment 2 Marcel de Rooy 2017-01-03 15:31:37 UTC
If nobody cares about it?
Comment 3 Martin Renvoize 2020-03-09 10:13:49 UTC
Created attachment 100333 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2020-03-09 10:14:15 UTC
A simple approach to reducing the attack surface of Koha.. Thanks Marcel

Signing off
Comment 5 Kyle M Hall 2020-03-20 11:32:06 UTC
Created attachment 101082 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Hayley Pelham 2020-04-20 02:17:33 UTC
Backported to 18.11.x for 18.11.16
Comment 7 Martin Renvoize 2020-04-27 09:45:55 UTC
Nice work everyone!

Pushed to master for 20.05