http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #1 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 16098 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=16098&action=edit Bug 9812 - Forbid access to several files through the browser This patch hides (-Indexes) and forbids (Deny from all) access to some stuff through a browser. Specifically "xlst", "modules" and "includes" dirs and its contents. This is just a quick fix we talked about at IRC. The proper solution would be to remove this from htdocs which will still be needed. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #2 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Test plan ========= - Install Koha from master - Go there in your browser: http://YOUR_DEV_KOHA_OPAC_FQDN/opac-tmpl/prog/en/ - You should be able to browse every dir in the templates dir - Apply the patch and reinstall using $ perl Makefile.PL --prev-install-log ~/path/to/koha-install-log - Retry, you shouldn't be able to browse or access any files in this dirs: * modules * xslt * includes For your convenience this paths should be valid for testing: /opac-tmpl/prog/en/modules/kohaerror.tt /opac-tmpl/prog/en/includes/usermenu.inc /opac-tmpl/prog/en/xslt/MARC21slim2OPACDetail.xsl /opac-tmpl/ccsr/en/includes/doc-head-close.inc This should do it for the staff client too, but... its too much work for such a trivial patch! -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Paul A <paul.a@aandc.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.a@aandc.org --- Comment #3 from Paul A <paul.a@aandc.org> --- Validated on my sandbox (Koha 3.8.5, Ubuntu 12.04.2 LTS), but note I'm not sure of the role of /etc/koha-httpd.conf (upgrades, etc?) as for every tarball install of Koha that I've ever done, I prefer etc/apache2/{whatever_file[s]}. This requires: service apache2 reload /etc/init.d/apache2 restart I'm also not sure why memcached is mentioned in the patch; the relevant SetEnv directives probably don't need to be touched. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #5 from Paul A <paul.a@aandc.org> --- (In reply to comment #4)

(In reply to comment #3)

...

Validated on my sandbox (Koha 3.8.5, Ubuntu 12.04.2 LTS), but note I'm not sure of the role of /etc/koha-httpd.conf (upgrades, etc?) as for every tarball install of Koha that I've ever done, I prefer etc/apache2/{whatever_file[s]}. This requires:

service apache2 reload /etc/init.d/apache2 restart

I'm glad it worked for you.

In fact, this only was tested on our 64-bit sandbox - our production server uses a slightly different approach (less elegant. A wider 'deny', then specific 'allows'), with the same result. I'll probably update production at next scheduled maintenance.

...

I'm also not sure why memcached is mentioned in the patch; the relevant SetEnv directives probably don't need to be touched.

They remain untouched, don't worry. The only modified lines are those that start with a plus (+) symbol.

My bad - read it too quickly - but of course did not modify our memcached directives. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #16098|0 |1 is obsolete| | --- Comment #6 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 17090 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=17090&action=edit Bug 9812 - Forbid access to several files through the browser This patch hides (-Indexes) and forbids (Deny from all) access to some stuff through a browser. Specifically "xlst", "modules" and "includes" dirs and its contents. This is just a quick fix we talked about at IRC. The proper solution would be to remove this from htdocs which will still be needed. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Jonathan Druart <jonathan.druart@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #17090|0 |1 is obsolete| | --- Comment #8 from Jonathan Druart <jonathan.druart@biblibre.com> --- Created attachment 17166 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=17166&action=edit Bug 9812 - Forbid access to several files through the browser This patch hides (-Indexes) and forbids (Deny from all) access to some stuff through a browser. Specifically "xlst", "modules" and "includes" dirs and its contents. This is just a quick fix we talked about at IRC. The proper solution would be to remove this from htdocs which will still be needed. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #10 from Chris Cormack <chris@bigballofwax.co.nz> --- Pushed to 3.10.x and 3.8.x will be in 3.10.6 and 3.8.13 -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|minor |blocker -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Moving this to Passed QA to make it show up in Jared's list - revert request from the patch author. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #14 from Chris Cormack <chris@bigballofwax.co.nz> --- Reverted from 3.10.x and 3.8.x -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |In Discussion Severity|blocker |normal --- Comment #16 from Galen Charlton <gmcharlt@gmail.com> --- (In reply to comment #13)

Just a *dumb* question: But why should these "open source files" -- by no means :) -- be exposed through the browser? Much of this stuff will be from the standard install, available online elsewhere. Some small customizations are probably not of a "to be hidden nature". The larger custom work that for some reason should not be public (pity btw! we encourage to submit patches) can be hidden by a pro :)

Not in any way wanting to discourage your sending of patches!

Well, the motivation isn't to hide code or customizations per se, it's to reduce the risk that the webserver could be made to send out sensitive configuration information, e.g., DB passwords or the like. In this specific case, there isn't anything (to my knowledge) in modules, xslt, and includes that would be useful to an attacker, although I could certainly see a customizer getting lazy and (say) hardcoding credentials into a template. The upshot is that I see this patch as a useful direction to be thinking towards, and I'm not opposed to pushing it (once Tomás' concerns are addressed), but I think even better would be to move Since the revert is done, I'm setting this one to in discussion. I'm also setting the the criticality back to 'normal'. If there is a *specific* security issue that warrants blocker status, please let me know. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEW -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9812 --- Comment #17 from Galen Charlton <gmcharlt@gmail.com> --- I just noticed that due to an apparent timing issue, this patch was never actually reverted from master. I'm going to run with leaving it in, as I have a patch series in progress in bug 10592 that fixes the value_builder and favicon issues. -- You are receiving this mail because: You are watching all bug changes.