That's not expected...
Created attachment 163138 [details] [review] Bug 36322: Redirect docs dir to 404 http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl Test plan: Hit the link => Erk Copy the apache config to /etc/koha/apache-shared-intranet-git.conf restart_all Hit the link => 404
I was going to say on bug 36323 that we could always return a 404 in some circumstances, but I thought it was a bit suboptimal. I can't remember where/when I suggested it, but years ago I suggested that we move web-facing code for the staff interface. We already have "opac" for the OPAC and "api" for the API. We could add a "staff_interface" or something for the staff interface, and move the web scripts into there. That would eliminate the need to do this 404 stuff. Of course, such a change would cause all kinds of patches to need rebasing and require us to use --follow when using "git log". It would mean short-term pain for long-term gain. (At some point, I'd also love to move the templates out of the web-facing "htdocs" and into a backend-only "tt" directory. But that's another related battle...)
(In reply to David Cook from comment #2) > I was going to say on bug 36323 that we could always return a 404 in some > circumstances, but I thought it was a bit suboptimal. > > I can't remember where/when I suggested it, but years ago I suggested that > we move web-facing code for the staff interface. We already have "opac" for > the OPAC and "api" for the API. We could add a "staff_interface" or > something for the staff interface, and move the web scripts into there. That > would eliminate the need to do this 404 stuff. Certainly bug 9949.
Does not appear in deb and tarball installs. Maybe no necessary, but should not hurt?
(In reply to Jonathan Druart from comment #4) > Does not appear in deb and tarball installs. Maybe no necessary, but should > not hurt? We use dev install so we will add it. Sounds better to have it in current config.
Oh there are others to protect, please confirm : api bin koha-tmpl: does not look dangerous but I found some python in GreyBox lib: this one is important no ? opac: maybe better hide this from staff interface skel Also looks unprotected : koha_perl_deps.pl kohaversion.pl Maybe we rename with .PL or move then.
This report is in the context of bug 24879 and will deal with "docs" only. Please open a separate bug report if you think further work is needed.
OK, I created Bug 36348
Created attachment 163401 [details] [review] Bug 36322: Redirect docs dir to 404 http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl Test plan: Hit the link => Erk Copy the apache config to /etc/koha/apache-shared-intranet-git.conf restart_all Hit the link => 404 Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Trivial and clear fix and other issues will be dealt with on other bugs in discussion at the moment.. I see no reason to hold up the tree and am going straight for PQA here.
Pushed to master-security.
Can someone please try and recreate this on 22.05.x? I can't seem to get the 404 Maybe I am following the test plan wrong, is it possible to get a more detailed one please?
(In reply to wainuiwitikapark from comment #12) > Can someone please try and recreate this on 22.05.x? > > I can't seem to get the 404 > > Maybe I am following the test plan wrong, is it possible to get a more > detailed one please? If you are using koha-testing-docker you can use the reset_all command, it will take care of copying the apache config file.
(In reply to Jonathan Druart from comment #13) > (In reply to wainuiwitikapark from comment #12) > > Can someone please try and recreate this on 22.05.x? > > > > I can't seem to get the 404 > > > > Maybe I am following the test plan wrong, is it possible to get a more > > detailed one please? > > If you are using koha-testing-docker you can use the reset_all command, it > will take care of copying the apache config file. Thanks Jonathan! I was able to get the 404 Backported to 22.05.x-security for 22.05.20