Marcel de Rooy
95dc574501
As a simple alternative to the solution in bug 9949 or just as an
additional measure, this patch adds a rewrite rule for intranet
in order to intercept potential misuse of perl scripts that could be
reached on a dev package install via the cgi-bin/koha scriptalias.
It simply rewrites them to the nonexistent "notfound", resulting in a
regular 404 error.
The rewrite rule does not harm regular installs and is just a little extra
step in securing a dev install. You should have more security measures in
place to secure your staff client.
QA Note: Although a rewrite rule may not be our first choice, this one
rule is more elegant and easier to maintain than e.g. a whole bunch of
aliases.
Note: This patch should have a regular and a dev install signoff.
Test plan:
[1] Make sure that this rewrite rule is inserted in your actual apache
config via /etc/koha/apache-shared-intranet.conf. Restart Apache.
[2] For regular package installs:
Try one of the URLs in step 3.
Verify that your staff client still operates as usual. Test a few
URLs inside some modules.
[3] For dev installs:
Try some URLs like below.
Expect 404 errors only, not 500s. If you do not see a 404, go back!
/misc/stage_file.pl
/t/db_dependent/default_search_class.pl
/installer/data/mysql/updatedatabase.pl
/Makefile.PL
[4] Do you see an additional directory to add to the regex? Please report.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
35 lines
1.3 KiB
Text
35 lines
1.3 KiB
Text
# Apache configuration settings that are shared for every Koha instance.
|
|
# This file contains settings for the intranet site.
|
|
#
|
|
# This file should be included from an instance's
|
|
# /etc/apache2/site-available file, from within the VirtualHost section
|
|
# for the intranet.
|
|
|
|
DocumentRoot /usr/share/koha/intranet/htdocs
|
|
|
|
ScriptAlias /cgi-bin/koha/ "/usr/share/koha/intranet/cgi-bin/"
|
|
ScriptAlias /index.html "/usr/share/koha/intranet/cgi-bin/mainpage.pl"
|
|
ScriptAlias /search "/usr/share/koha/intranet/cgi-bin/catalogue/search.pl"
|
|
|
|
# Protect dev package install
|
|
RewriteEngine on
|
|
RewriteRule ^/cgi-bin/koha/(C4|debian|etc|installer/data|install_misc|Koha|misc|selenium|t|test|tmp|xt)/|\.PL$ /notfound [PT]
|
|
|
|
RewriteCond %{QUERY_STRING} (.*?)(?:[A-Za-z0-9_-]+)=&(.*)
|
|
RewriteRule (.+) $1?%1%2 [N,R,NE]
|
|
RewriteRule ^/bib/([^\/]*)/?$ /cgi-bin/koha/catalogue/detail.pl?biblionumber=$1 [PT]
|
|
RewriteRule ^/isbn/([^\/]*)/?$ /search?q=isbn:$1 [PT]
|
|
RewriteRule ^/issn/([^\/]*)/?$ /search?q=issn:$1 [PT]
|
|
RewriteRule ^(.*)_[0-9]{2}\.[0-9]{7}\.(js|css)$ $1.$2 [L]
|
|
|
|
Alias "/api" "/usr/share/koha/api"
|
|
<Directory "/usr/share/koha/api">
|
|
Options +ExecCGI +FollowSymlinks
|
|
AddHandler cgi-script .pl
|
|
|
|
SetEnv MOJO_MODE "production"
|
|
|
|
RewriteBase /api/
|
|
RewriteCond %{REQUEST_URI} !^/api/v[0-1]+/app.pl
|
|
RewriteRule ^(v[0-9]+)/(.*)$ /api/$1/app.pl/api/$1/$2 [L]
|
|
</Directory>
|