Bug #2254: The WebDAV access for the inventories on the rudder should not allow a GET access (aka should not give a nice index of the incoming directory but a 403 error instead) - Rudder - Issue Tracker

Actions

Copy link

Bug #2254

closed

The WebDAV access for the inventories on the rudder should not allow a GET access (aka should not give a nice index of the incoming directory but a 403 error instead)

Added by Matthieu CERDA almost 13 years ago. Updated over 9 years ago.

Status:

Released

Priority:

1 (highest)

Assignee:

Matthieu CERDA

Category:

Web - Nodes & inventories

Target version:

2.3.7

Pull Request:

Severity:

UX impact:

User visibility:

Effort required:

Priority:

Name check:

Fix check:

Regression:

Description

The WebDAV access for the inventories on the rudder should not allow a GET access (aka should not give a nice index of the incoming directory but a 403 error instead)

On SLES it is already the case but the Debian Apache seems to accepts any access gratefully

Actions

Copy link

Updated by Matthieu CERDA almost 13 years ago

Tracker changed from User story to Bug

Actions

Copy link

Updated by Matthieu CERDA almost 13 years ago

Status changed from New to Discussion
Assignee set to Jonathan CLARKE

Well in fact it does not allow an unauthenticated access. It seems that when I did it firefox was already authenticated, after clearing my cache and auth sessions, I get a password prompt as wanted.

Reject this please :)

Actions

Copy link

Updated by Jonathan CLARKE almost 13 years ago

Status changed from Discussion to 2
Assignee changed from Jonathan CLARKE to Matthieu CERDA
Target version changed from 2.4.0~alpha5 to 2.4.0~alpha6

I disagree: the login/password can be easily found from any node managed from Rudder, so any administrator of one node could get it. This means the admin from one node can see (potentially sensitive) data about other nodes.

Even with the password, I believe GET should be forbidden. Retargeting for the next run.

Actions

Copy link