Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #3772, allows Authorization header to pass #3774

Merged
merged 2 commits into from
Sep 5, 2018
Merged

Fixes #3772, allows Authorization header to pass #3774

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2aecf1c
Fixes #3772, allows Authorization header to pass
kushaldas Sep 4, 2018
f3e81ca
Adds WSGIPassAuthorization header via postinst
Sep 4, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions install_files/ansible-base/roles/app/templates/sites-available/journalist.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ ServerName {{ securedrop_app_apache_listening_address }}
WSGIDaemonProcess journalist processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop
WSGIProcessGroup journalist
WSGIScriptAlias / /var/www/journalist.wsgi
WSGIPassAuthorization On

# Tell the browser not to cache HTML responses in order to minimize the chance
# of the inadvertent release or retention of sensitive data. For more, see
Expand Down
16 changes: 16 additions & 0 deletions install_files/securedrop-app-code/DEBIAN/postinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,19 @@ database_migration() {
fi
}

# Supports passing authorization headers for the SecureDrop API.
# Only affects the Journalist Interface. Required for unattended upgrade
# to v0.9.0.
function permit_wsgi_authorization() {
journalist_conf="/etc/apache2/sites-available/journalist.conf"
# First we check whether the line is present.
# Next we find a target line to anchor the insertion.
# Then we insert the line, along with the target line that was matched.
if ! grep -qP '^WSGIPassAuthorization' "$journalist_conf"; then
perl -pi -e 's/^(WSGIScriptAlias .*)/$1\nWSGIPassAuthorization On/' "$journalist_conf"
fi
}

case "$1" in
configure)
# Ensure SecureDrop's necessary directories are created
Expand Down Expand Up @@ -99,6 +112,9 @@ case "$1" in
aa-enforce /etc/apparmor.d/usr.sbin.tor
aa-enforce /etc/apparmor.d/usr.sbin.apache2

# Munge Apache config while service is stopped.
permit_wsgi_authorization

# Restart apache so it loads with the apparmor profiles in enforce mode.
service apache2 restart

Expand Down
1 change: 1 addition & 0 deletions molecule/testinfra/staging/app/apache/test_apache_journalist_interface.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ def test_apache_headers_journalist_interface(File, header):
securedrop_test_vars.securedrop_code),
'WSGIProcessGroup journalist',
'WSGIScriptAlias / /var/www/journalist.wsgi',
'WSGIPassAuthorization On',
'Header set Cache-Control "no-store"',
"Alias /static {}/static".format(securedrop_test_vars.securedrop_code),
"""
Expand Down