Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 16922: Add RewriteRule to apache-shared-intranet for dev package installs

Browse source 
As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.

It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.

The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.

QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.

Note: This patch should have a regular and a dev install signoff.

Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
    config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
    Try one of the URLs in step 3.
    Verify that your staff client still operates as usual. Test a few
    URLs inside some modules.
[3] For dev installs:
    Try some URLs like below.
    Expect 404 errors only, not 500s. If you do not see a 404, go back!
    /misc/stage_file.pl
    /t/db_dependent/default_search_class.pl
    /installer/data/mysql/updatedatabase.pl
    /Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Marcel de Rooy 2016-07-14 13:51:21 +02:00 committed by Martin Renvoize
parent b50d891c09
commit 95dc574501
Signed by: martin.renvoize
GPG key ID: 422B469130441A0F
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
debian/templates/apache-shared-intranet.conf vendored
View file

@ -11,6 +11,9 @@ ScriptAlias /cgi-bin/koha/ "/usr/share/koha/intranet/cgi-bin/"
ScriptAlias /index.html "/usr/share/koha/intranet/cgi-bin/mainpage.pl"
ScriptAlias /search "/usr/share/koha/intranet/cgi-bin/catalogue/search.pl"
# Protect dev package install
RewriteEngine on
RewriteRule ^/cgi-bin/koha/(C4|debian|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]
RewriteCond %{QUERY_STRING} (.*?)(?:[A-Za-z0-9_-]+)=&(.*)
RewriteRule (.+) $1?%1%2 [N,R,NE]