Bug 36322 - Can run docs/**/*.pl from the UI
Summary: Can run docs/**/*.pl from the UI
Status: Pushed to oldoldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Martin Renvoize
URL:
Keywords:
Depends on:
Blocks: 24879 36348
  Show dependency treegraph
 
Reported: 2024-03-14 15:40 UTC by Jonathan Druart
Modified: 2024-04-03 12:09 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.04,23.05.10,22.11.16,22.05.20


Attachments
Bug 36322: Redirect docs dir to 404 (1.31 KB, patch)
2024-03-14 15:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36322: Redirect docs dir to 404 (1.37 KB, patch)
2024-03-19 11:32 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2024-03-14 15:40:26 UTC
That's not expected...
Comment 1 Jonathan Druart 2024-03-14 15:43:24 UTC
Created attachment 163138 [details] [review]
Bug 36322: Redirect docs dir to 404

http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl

Test plan:
Hit the link
=> Erk
Copy the apache config to /etc/koha/apache-shared-intranet-git.conf
restart_all
Hit the link
=> 404
Comment 2 David Cook 2024-03-14 23:02:27 UTC
I was going to say on bug 36323 that we could always return a 404 in some circumstances, but I thought it was a bit suboptimal.

I can't remember where/when I suggested it, but years ago I suggested that we move web-facing code for the staff interface. We already have "opac" for the OPAC and "api" for the API. We could add a "staff_interface" or something for the staff interface, and move the web scripts into there. That would eliminate the need to do this 404 stuff. 

Of course, such a change would cause all kinds of patches to need rebasing and require us to use --follow when using "git log". It would mean short-term pain for long-term gain.

(At some point, I'd also love to move the templates out of the web-facing "htdocs" and into a backend-only "tt" directory. But that's another related battle...)
Comment 3 Jonathan Druart 2024-03-15 07:36:33 UTC
(In reply to David Cook from comment #2)
> I was going to say on bug 36323 that we could always return a 404 in some
> circumstances, but I thought it was a bit suboptimal.
> 
> I can't remember where/when I suggested it, but years ago I suggested that
> we move web-facing code for the staff interface. We already have "opac" for
> the OPAC and "api" for the API. We could add a "staff_interface" or
> something for the staff interface, and move the web scripts into there. That
> would eliminate the need to do this 404 stuff. 

Certainly bug 9949.
Comment 4 Jonathan Druart 2024-03-15 09:21:20 UTC
Does not appear in deb and tarball installs. Maybe no necessary, but should not hurt?
Comment 5 Fridolin Somers 2024-03-15 13:54:56 UTC
(In reply to Jonathan Druart from comment #4)
> Does not appear in deb and tarball installs. Maybe no necessary, but should
> not hurt?

We use dev install so we will add it.
Sounds better to have it in current config.
Comment 6 Fridolin Somers 2024-03-15 14:10:36 UTC
Oh there are others to protect, please confirm :
api
bin
koha-tmpl: does not look dangerous but I found some python in GreyBox
lib: this one is important no ?
opac: maybe better hide this from staff interface
skel

Also looks unprotected : 
koha_perl_deps.pl
kohaversion.pl
Maybe we rename with .PL or move then.
Comment 7 Jonathan Druart 2024-03-15 14:22:54 UTC
This report is in the context of bug 24879 and will deal with "docs" only. Please open a separate bug report if you think further work is needed.
Comment 8 Fridolin Somers 2024-03-18 15:41:12 UTC
OK, I created Bug 36348
Comment 9 Martin Renvoize 2024-03-19 11:32:00 UTC
Created attachment 163401 [details] [review]
Bug 36322: Redirect docs dir to 404

http://localhost:8081/cgi-bin/koha/docs/CAS/CASProxy/examples/proxy_cas.pl

Test plan:
Hit the link
=> Erk
Copy the apache config to /etc/koha/apache-shared-intranet-git.conf
restart_all
Hit the link
=> 404

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize 2024-03-19 11:34:09 UTC
Trivial and clear fix and other issues will be dealt with on other bugs in discussion at the moment.. I see no reason to hold up the tree and am going straight for PQA here.
Comment 11 Katrin Fischer 2024-03-20 16:44:58 UTC
Pushed to master-security.
Comment 12 wainuiwitikapark 2024-03-20 22:47:15 UTC
Can someone please try and recreate this on 22.05.x?

I can't seem to get the 404

Maybe I am following the test plan wrong, is it possible to get a more detailed one please?
Comment 13 Jonathan Druart 2024-03-21 07:22:26 UTC
(In reply to wainuiwitikapark from comment #12)
> Can someone please try and recreate this on 22.05.x?
> 
> I can't seem to get the 404
> 
> Maybe I am following the test plan wrong, is it possible to get a more
> detailed one please?

If you are using koha-testing-docker you can use the reset_all command, it will take care of copying the apache config file.
Comment 14 wainuiwitikapark 2024-03-21 21:27:34 UTC
(In reply to Jonathan Druart from comment #13)
> (In reply to wainuiwitikapark from comment #12)
> > Can someone please try and recreate this on 22.05.x?
> > 
> > I can't seem to get the 404
> > 
> > Maybe I am following the test plan wrong, is it possible to get a more
> > detailed one please?
> 
> If you are using koha-testing-docker you can use the reset_all command, it
> will take care of copying the apache config file.

Thanks Jonathan!

I was able to get the 404

Backported to 22.05.x-security for 22.05.20