Bug 16922

Summary: Add RewriteRule to apache-shared-intranet for dev package installs
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: Architecture, internals, and plumbingAssignee: Marcel de Rooy <m.de.rooy>
Status: CLOSED FIXED QA Contact:
Severity: normal    
Priority: P5 - low CC: 1joynelson, fridolin.somers, hayleypelham, jonathan.druart, katrin.fischer, lucas, martin.renvoize, mtj, nick
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9949
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.05, 19.05.10, 18.11.16
Attachments: Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

Description Marcel de Rooy 2016-07-14 12:00:05 UTC

    
Comment 1 Marcel de Rooy 2016-07-15 06:50:02 UTC
Created attachment 53410 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.
Comment 2 Marcel de Rooy 2017-01-03 15:31:37 UTC
If nobody cares about it?
Comment 3 Martin Renvoize 2020-03-09 10:13:49 UTC
Created attachment 100333 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2020-03-09 10:14:15 UTC
A simple approach to reducing the attack surface of Koha.. Thanks Marcel

Signing off
Comment 5 Kyle M Hall 2020-03-20 11:32:06 UTC
Created attachment 101082 [details] [review]
Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 6 Hayley Pelham 2020-04-20 02:17:33 UTC
Backported to 18.11.x for 18.11.16
Comment 7 Martin Renvoize 2020-04-27 09:45:55 UTC
Nice work everyone!

Pushed to master for 20.05