java/code/src/com/redhat/rhn/common/conf/ConfigDefaults.java |
20 +++++++
java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java |
28 ++++++++++
java/code/src/com/redhat/rhn/frontend/xmlrpc/configchannel/ConfigChannelHandler.java |
5 +
3 files changed, 53 insertions(+)
New commits:
commit 49e57701b690367f272fc86e973bb6a33fc1f881
Author: Justin Sherrill <jsherril(a)redhat.com>
Date: Wed Dec 2 13:30:12 2009 -0500
updating configchannel.createOrUpdatePath to include documentation about Selinux, and
make it optional
diff --git
a/java/code/src/com/redhat/rhn/frontend/xmlrpc/configchannel/ConfigChannelHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/configchannel/ConfigChannelHandler.java
index 2ac091e..1d0357b 100644
---
a/java/code/src/com/redhat/rhn/frontend/xmlrpc/configchannel/ConfigChannelHandler.java
+++
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/configchannel/ConfigChannelHandler.java
@@ -241,6 +241,7 @@ public class ConfigChannelHandler extends BaseHandler {
* #prop_desc("string", "group", "Group name of the
file/directory.")
* #prop_desc("string", "permissions",
* "Octal file/directory permissions (eg:
644)")
+ * #prop_desc("string", "selinux_ctx", "SELinux
Security context (optional)")
* #prop_desc("string", "macro-start-delimiter",
* "Config file macro start delimiter. Use null or empty
* string to accept the default. (ignored if working with a
@@ -270,6 +271,10 @@ public class ConfigChannelHandler extends BaseHandler {
validKeys.add("macro-end-delimiter");
validateMap(validKeys, data);
+ if (data.get("selinux_ctx") == null) {
+ data.put("selinux_ctx", "");
+ }
+
User user = getLoggedInUser(sessionKey);
XmlRpcConfigChannelHelper helper = XmlRpcConfigChannelHelper.getInstance();
ConfigChannel channel = helper.lookupGlobal(user, channelLabel);
commit e4b154990b1f28fd33abc2789c32da12875c1e6a
Author: Justin Sherrill <jsherril(a)redhat.com>
Date: Wed Dec 2 13:28:19 2009 -0500
529483 - adding referer check for HTTP requests to java stack
diff --git a/java/code/src/com/redhat/rhn/common/conf/ConfigDefaults.java
b/java/code/src/com/redhat/rhn/common/conf/ConfigDefaults.java
index 976b902..ff0d156 100644
--- a/java/code/src/com/redhat/rhn/common/conf/ConfigDefaults.java
+++ b/java/code/src/com/redhat/rhn/common/conf/ConfigDefaults.java
@@ -17,6 +17,8 @@ package com.redhat.rhn.common.conf;
import org.apache.commons.lang.StringUtils;
import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
/**
* ConfigDefaults is the place to store application specific Config settings
@@ -147,6 +149,8 @@ public class ConfigDefaults {
public static final String SPACEWALK_REPOSYNC_PATH =
"spacewalk_reposync_path";
public static final String SPACEWALK_REPOSYNC_LOG_PATH =
"spacewalk_reposync_logpath";
+ public static final String NON_REFERER_URLS = "non_referer_urls";
+
private ConfigDefaults() {
}
@@ -394,6 +398,22 @@ public class ConfigDefaults {
}
/**
+ * Get the list of Url paths that we don't do the referer check on
+ * @return The list of strings
+ */
+ public List<String> getNonRefererUrls() {
+ List<String> toRet = Config.get().getList(NON_REFERER_URLS);
+ if (toRet == null) {
+ toRet = new ArrayList<String>();
+ }
+ toRet.add("/Login.do");
+ toRet.add("/ReLogin.do");
+ toRet.add("/index.jsp");
+ toRet.add("/YourRhn.do");
+ return toRet;
+ }
+
+ /**
* Return true if this is a Spacewalk instance. (as opposed to Satellite)
* @return true is this is a Spacewalk instance.
*/
diff --git a/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
b/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
index 6d22ced..b03ceff 100644
--- a/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
+++ b/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
@@ -15,17 +15,22 @@
package com.redhat.rhn.frontend.servlets;
+import com.redhat.rhn.common.conf.ConfigDefaults;
import com.redhat.rhn.frontend.security.AuthenticationService;
import com.redhat.rhn.frontend.security.AuthenticationServiceFactory;
import org.apache.log4j.Logger;
import java.io.IOException;
+import java.net.URL;
import java.util.Date;
+import java.util.Enumeration;
+import java.util.List;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
+import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
@@ -61,6 +66,8 @@ public class AuthFilter implements Filter {
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
+
+
if (log.isDebugEnabled()) {
log.debug("ENTER AuthFilter.doFilter: " + request.getRemoteAddr() +
" [" + new Date() + "] (" +
@@ -69,6 +76,27 @@ public class AuthFilter implements Filter {
if (authenticationService.validate((HttpServletRequest)request,
(HttpServletResponse)response)) {
+
+ //Check the referrer and redirect to YourRhn.do if it doesn't match
+ HttpServletRequest hreq = new
+ RhnHttpServletRequest((HttpServletRequest)request);
+ Enumeration em = hreq.getHeaders("referer");
+ if (em.hasMoreElements()) {
+ String urlString = (String) em.nextElement();
+ URL url = new URL(urlString);
+ List goodUrls = ConfigDefaults.get().getNonRefererUrls();
+ if (!goodUrls.contains(hreq.getServletPath()) &&
+ !request.getLocalName().equals(url.getHost())) {
+ log.fatal("Referrer (" + url.getHost() + ") for url
" +
+ hreq.getServletPath() +
+ " does not match. Redirecting to
/rhn/YourRhn.do.");
+ RequestDispatcher dispatcher = request.getRequestDispatcher(
+ "/YourRhn.do");
+ dispatcher.forward(request, response);
+ return;
+ }
+ }
+
chain.doFilter(request, response);
}
Show replies by date