Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 544566 - www-apps/rt[-lighttpd]: Uses insecure AddHandler directive
Summary: www-apps/rt[-lighttpd]: Uses insecure AddHandler directive
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Web Application Packages Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 544560
  Show dependency tree
 
Reported: 2015-03-26 15:56 UTC by Sebastian Pipping
Modified: 2015-05-19 15:49 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Pipping gentoo-dev 2015-03-26 15:56:11 UTC
I would rather not delete that file myself without review from your side.
To my understanding, it is unused and can be deleted.

# fgrep -Rl 'rt_apache2_fcgi.conf' .
./ChangeLog
./Manifest

The reason why I would like to have it removed is the use of AddHandler:

# fgrep -R AddHandler .
./files/rt_apache2_fcgi.conf:   AddHandler fastcgi-script fcgi

Please see bug #538822 for why that is a problem.

Thank you!
Comment 1 Sebastian Pipping gentoo-dev 2015-03-26 16:25:28 UTC
Update:

I just found that my call to grep was the problem.  The file is actually still used:

  doins "${FILESDIR}"/rt_apache2{,_fcgi}.conf

So a fix is needed rather than removal.  Please see bug #538822 for a proposed fixed.

Thank you!
Comment 2 Aaron W. Swenson gentoo-dev 2015-05-14 18:40:29 UTC
The included files are there as samples, but I have altered the fcgi sample. The admin has to do a bit of tweaking to make it happen, though. (In fact, we may want to consider removing them altogether in favor of the wiki.)
Comment 3 Sebastian Pipping gentoo-dev 2015-05-14 18:53:42 UTC
Hi!

I'm happy with anything that doesn't use AddHandler or AddType :)
I noticed the

<Location />
    SetHandler modperl
    [..]
</Location>

in there.  I wonder if that makes modperl handle static content (if any) too and if that works or not.  If the recommendation is broken (if!), users would probably add some AddHandler in themselves again to make it work.  My vote for a comment on why we avoid Addhandler/AddType in that file (or in the Wiki if the file is removed).

Best, Sebastian
Comment 4 Aaron W. Swenson gentoo-dev 2015-05-14 19:14:47 UTC
I've already worked on the wiki article a lot. I've only used Apache and mod_perl as I use that combination for other things as well.

https://wiki.gentoo.org/wiki/Request_Tracker

If the other sections get the love they need, we can get rid of the samples we ship with the ebuild. I'm not so terribly interested in FastCGI or Lighttpd, and I don't have time to have an interest in them.
Comment 5 Aaron W. Swenson gentoo-dev 2015-05-18 20:40:05 UTC
(In reply to Sebastian Pipping from comment #3)
> Hi!
> 
> I'm happy with anything that doesn't use AddHandler or AddType :)
> I noticed the
> 
> <Location />
>     SetHandler modperl
>     [..]
> </Location>
> 
> in there.  I wonder if that makes modperl handle static content (if any) too
> and if that works or not.  If the recommendation is broken (if!), users
> would probably add some AddHandler in themselves again to make it work.  My
> vote for a comment on why we avoid Addhandler/AddType in that file (or in
> the Wiki if the file is removed).
> 
> Best, Sebastian

Yes, SetHandler causes everything within the directory to be parsed through modperl, which will cause things to start issuing 500-type errors, I'm sure. The intention is that RT is the only thing under that location and isn't being shared with other static or dynamic content.

Also, the official docs has a configuration significantly different from what we're suggesting:

https://bestpractical.com/docs/rt/4.2/web_deployment.html#mod_fastcgi

Our wiki definitely needs an update in this area. As I mentioned, I've never used FastCGI so I'm uncomfortable with making suggestions regarding it, but have made the change anyway except with SetHandler.

I think we'd be safe to remove the included .conf files, and any references to them.
Comment 6 Sebastian Pipping gentoo-dev 2015-05-19 00:06:58 UTC
(In reply to Aaron W. Swenson from comment #5)
> Also, the official docs has a configuration significantly different from
> what we're suggesting:
> 
> https://bestpractical.com/docs/rt/4.2/web_deployment.html#mod_fastcgi

They have

  <Location />
    [..]
    SetHandler modperl
    [..]
  </Location>

without <FilesMatch> so I guess we can use that, too.

Sadly, they have other examples using AddHandler on that very page, too.
I guess I need to mail them to fix it.
Comment 7 Aaron W. Swenson gentoo-dev 2015-05-19 15:49:43 UTC
*rt-4.2.11 (19 May 2015)

  19 May 2015; Aaron W. Swenson <titanofold@gentoo.org> -rt-4.2.9-r1.ebuild,
  +rt-4.2.11.ebuild, +files/rt-makefile-serialize-install-prereqs.patch,
  -files/rt_apache2_fcgi.conf, -files/rt_apache2.conf:
  Address security bug 542882. Add patch fixing bug 540014 to serialize
  primary build targets while still allowing parallel building on
  subtargets. Remove outdated Apache configuration examples fixing bug
  544566. Users should follow the online guide.