| Summary: | Add RewriteRule to apache-shared-intranet for dev package installs | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | Architecture, internals, and plumbing | Assignee: | Marcel de Rooy <m.de.rooy> |
| Status: | CLOSED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | 1joynelson, fridolin.somers, hayleypelham, jonathan.druart, lucas, martin.renvoize, mtj, nick |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9949 | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
20.05.00, 19.11.05, 19.05.10, 18.11.16
|
|
| Circulation function: | |||
| Attachments: |
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs |
||
|
Description
Marcel de Rooy
2016-07-14 12:00:05 UTC
Created attachment 53410 [details] [review] Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs As a simple alternative to the solution in bug 9949 or just as an additional measure, this patch adds a rewrite rule for intranet in order to intercept potential misuse of perl scripts that could be reached on a dev package install via the cgi-bin/koha scriptalias. It simply rewrites them to the nonexistent "notfound", resulting in a regular 404 error. The rewrite rule does not harm regular installs and is just a little extra step in securing a dev install. You should have more security measures in place to secure your staff client. QA Note: Although a rewrite rule may not be our first choice, this one rule is more elegant and easier to maintain than e.g. a whole bunch of aliases. Note: This patch should have a regular and a dev install signoff. Test plan: [1] Make sure that this rewrite rule is inserted in your actual apache config via /etc/koha/apache-shared-intranet.conf. Restart Apache. [2] For regular package installs: Try one of the URLs in step 3. Verify that your staff client still operates as usual. Test a few URLs inside some modules. [3] For dev installs: Try some URLs like below. Expect 404 errors only, not 500s. If you do not see a 404, go back! /misc/stage_file.pl /t/db_dependent/default_search_class.pl /installer/data/mysql/updatedatabase.pl /Makefile.PL [4] Do you see an additional directory to add to the regex? Please report. If nobody cares about it? Created attachment 100333 [details] [review] Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs As a simple alternative to the solution in bug 9949 or just as an additional measure, this patch adds a rewrite rule for intranet in order to intercept potential misuse of perl scripts that could be reached on a dev package install via the cgi-bin/koha scriptalias. It simply rewrites them to the nonexistent "notfound", resulting in a regular 404 error. The rewrite rule does not harm regular installs and is just a little extra step in securing a dev install. You should have more security measures in place to secure your staff client. QA Note: Although a rewrite rule may not be our first choice, this one rule is more elegant and easier to maintain than e.g. a whole bunch of aliases. Note: This patch should have a regular and a dev install signoff. Test plan: [1] Make sure that this rewrite rule is inserted in your actual apache config via /etc/koha/apache-shared-intranet.conf. Restart Apache. [2] For regular package installs: Try one of the URLs in step 3. Verify that your staff client still operates as usual. Test a few URLs inside some modules. [3] For dev installs: Try some URLs like below. Expect 404 errors only, not 500s. If you do not see a 404, go back! /misc/stage_file.pl /t/db_dependent/default_search_class.pl /installer/data/mysql/updatedatabase.pl /Makefile.PL [4] Do you see an additional directory to add to the regex? Please report. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> A simple approach to reducing the attack surface of Koha.. Thanks Marcel Signing off Created attachment 101082 [details] [review] Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs As a simple alternative to the solution in bug 9949 or just as an additional measure, this patch adds a rewrite rule for intranet in order to intercept potential misuse of perl scripts that could be reached on a dev package install via the cgi-bin/koha scriptalias. It simply rewrites them to the nonexistent "notfound", resulting in a regular 404 error. The rewrite rule does not harm regular installs and is just a little extra step in securing a dev install. You should have more security measures in place to secure your staff client. QA Note: Although a rewrite rule may not be our first choice, this one rule is more elegant and easier to maintain than e.g. a whole bunch of aliases. Note: This patch should have a regular and a dev install signoff. Test plan: [1] Make sure that this rewrite rule is inserted in your actual apache config via /etc/koha/apache-shared-intranet.conf. Restart Apache. [2] For regular package installs: Try one of the URLs in step 3. Verify that your staff client still operates as usual. Test a few URLs inside some modules. [3] For dev installs: Try some URLs like below. Expect 404 errors only, not 500s. If you do not see a 404, go back! /misc/stage_file.pl /t/db_dependent/default_search_class.pl /installer/data/mysql/updatedatabase.pl /Makefile.PL [4] Do you see an additional directory to add to the regex? Please report. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Backported to 18.11.x for 18.11.16 Nice work everyone! Pushed to master for 20.05 |