monitoring/SputLite/html/cgi-bin/.htaccess | 1
monitoring/SputLite/html/cgi-bin/.new | 1
rel-eng/packages/spacewalk-web | 2
spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf | 25 +++---
web/html/network/systems/.htaccess | 6 -
web/modules/pxt/PXT/Apache24Config.pm | 62 ++++++++++++++++
web/modules/pxt/PXT/ApacheAuth.pm | 49 ++++--------
web/spacewalk-web.spec | 12 ++-
8 files changed, 104 insertions(+), 54 deletions(-)
New commits:
commit 91635882685dc03133b4b4769246dcc1ebc8497b
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 23:44:40 2013 +0100
Automatic commit of package [spacewalk-web] release [1.9.15-1].
diff --git a/rel-eng/packages/spacewalk-web b/rel-eng/packages/spacewalk-web
index c2243af..bfe2c4f 100644
--- a/rel-eng/packages/spacewalk-web
+++ b/rel-eng/packages/spacewalk-web
@@ -1 +1 @@
-1.9.14-1 web/
+1.9.15-1 web/
diff --git a/web/spacewalk-web.spec b/web/spacewalk-web.spec
index 54e90e0..5ddff76 100644
--- a/web/spacewalk-web.spec
+++ b/web/spacewalk-web.spec
@@ -2,7 +2,7 @@ Name: spacewalk-web
Summary: Spacewalk Web site - Perl modules
Group: Applications/Internet
License: GPLv2
-Version: 1.9.14
+Version: 1.9.15
Release: 1%{?dist}
URL:
https://fedorahosted.org/spacewalk/
Source0:
https://fedorahosted.org/releases/s/p/spacewalk/%{name}-%{version}.tar.gz
@@ -256,6 +256,16 @@ rm -rf $RPM_BUILD_ROOT
# $Id$
%changelog
+* Fri Feb 08 2013 Michael Mraka <michael.mraka(a)redhat.com> 1.9.15-1
+- $reqs was always equal $passes
+- acl is the only one supported type now
+- removed unused valid-user type
+- make pxt ACL work in apache 2.4
+- simplify @requires list
+- merged .htaccess to main httpd configuration
+- Silence the Statement unlikely to be reached at /usr/bin/db-control line 29
+ warning.
+
* Wed Feb 06 2013 Stephen Herr <sherr(a)redhat.com> 1.9.14-1
- Make it possible to run db-control without doing su - oracle first.
commit f94f05035558ce7212af3684011fd19d7dc20282
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 22:59:12 2013 +0100
$reqs was always equal $passes
otherwise we must have return FORBIDDEN after eval_acl()
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 579a9ba..5560075 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -115,10 +115,7 @@ sub authz_handler {
: map {$_->{requirement} =~ s/^acl\s+//;
$_->{requirement};} @{$r->requires});
- my ($reqs, $passes);
-
foreach my $entry (@requires) {
- $reqs++;
# support addition mixin'able acls directly from the .htaccess file...
my @mixins;
@@ -135,19 +132,12 @@ sub authz_handler {
warn "acl fail: $entry";
return FORBIDDEN;
}
- $passes++;
}
# $r->log_reason('User ' . $user->login . ' not allowed by
"require"');
- if ($reqs == $passes) {
- $session->uid($user_id);
- return OK;
- }
- else {
- warn "User did not pass all auth requisites ($passes/$reqs matched)";
- return FORBIDDEN;
- }
+ $session->uid($user_id);
+ return OK;
}
1;
commit b4b7c733d95fd7d6bb4a8519b905994f075f2d5b
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 22:57:33 2013 +0100
fixed indent
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 7ed3773..579a9ba 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -120,22 +120,22 @@ sub authz_handler {
foreach my $entry (@requires) {
$reqs++;
- # support addition mixin'able acls directly from the .htaccess file...
- my @mixins;
- while ($entry =~ m/mixin\s+(.*?)\s+/g) {
- push @mixins, $1;
- }
+ # support addition mixin'able acls directly from the .htaccess file...
+ my @mixins;
+ while ($entry =~ m/mixin\s+(.*?)\s+/g) {
+ push @mixins, $1;
+ }
- # clean up the string for the acl parser...
- $entry =~ s{mixin\s+.*?\s+}{}g;
+ # clean up the string for the acl parser...
+ $entry =~ s{mixin\s+.*?\s+}{}g;
- my $acl_parser = new PXT::ACL(mixins => \@mixins);
+ my $acl_parser = new PXT::ACL(mixins => \@mixins);
- if (not $acl_parser->eval_acl($pxt, $entry)) {
- warn "acl fail: $entry";
- return FORBIDDEN;
- }
- $passes++;
+ if (not $acl_parser->eval_acl($pxt, $entry)) {
+ warn "acl fail: $entry";
+ return FORBIDDEN;
+ }
+ $passes++;
}
# $r->log_reason('User ' . $user->login . ' not allowed by
"require"');
commit 015a44ade4f4c6aae440a1c95ab5cb7cb6a40501
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 22:34:21 2013 +0100
acl is the only one supported type now
diff --git a/web/modules/pxt/PXT/Apache24Config.pm
b/web/modules/pxt/PXT/Apache24Config.pm
index 8844fd4..f254ea6 100644
--- a/web/modules/pxt/PXT/Apache24Config.pm
+++ b/web/modules/pxt/PXT/Apache24Config.pm
@@ -53,7 +53,7 @@ sub acl_check_authorization {
# print acl to log.
#$r->log_error($require_args);
PXT::ApacheAuth::handler($r);
- return (PXT::ApacheAuth::authz_handler($r, "acl $require_args") ==
Apache2::Const::OK ?
+ return (PXT::ApacheAuth::authz_handler($r, $require_args) == Apache2::Const::OK
?
Apache2::Const::AUTHZ_GRANTED : Apache2::Const::AUTHZ_DENIED);
}
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 1ae0dc1..7ed3773 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -112,16 +112,14 @@ sub authz_handler {
my $pxt = $r->pnotes('pxt_request');
my @requires = ($acl_require ? ($acl_require)
- : map {$_->{requirement}} @{$r->requires});
+ : map {$_->{requirement} =~ s/^acl\s+//;
+ $_->{requirement};} @{$r->requires});
my ($reqs, $passes);
foreach my $entry (@requires) {
- my ($type, $string) = split /\s+/, $entry, 2;
$reqs++;
- if ($type eq 'acl') {
-
# support addition mixin'able acls directly from the .htaccess file...
my @mixins;
while ($entry =~ m/mixin\s+(.*?)\s+/g) {
@@ -129,19 +127,15 @@ sub authz_handler {
}
# clean up the string for the acl parser...
- $string =~ s{mixin\s+.*?\s+}{}g;
+ $entry =~ s{mixin\s+.*?\s+}{}g;
my $acl_parser = new PXT::ACL(mixins => \@mixins);
- if (not $acl_parser->eval_acl($pxt, $string)) {
- warn "acl fail: $string";
+ if (not $acl_parser->eval_acl($pxt, $entry)) {
+ warn "acl fail: $entry";
return FORBIDDEN;
}
$passes++;
- }
- else {
- die "Unknown 'require' type '$type' in .htaccess";
- }
}
# $r->log_reason('User ' . $user->login . ' not allowed by
"require"');
commit a22db60b7c28bd964514e78377d4ae2f201e5887
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 22:34:21 2013 +0100
removed unused valid-user type
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 9a61861..1ae0dc1 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -120,10 +120,7 @@ sub authz_handler {
my ($type, $string) = split /\s+/, $entry, 2;
$reqs++;
- if ($type eq 'valid-user') {
- $passes++;
- }
- elsif ($type eq 'acl') {
+ if ($type eq 'acl') {
# support addition mixin'able acls directly from the .htaccess file...
my @mixins;
commit 5e81aade2a5697a0e526d19ea2d692698ccdc042
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 22:26:47 2013 +0100
don't overload standard valid-user keyword
it's proccessed by mod_authz_core in apache 2.4 and doesn't call
our perl handler
diff --git a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
index 7c2e787..2dae7d5 100644
--- a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
+++ b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
@@ -210,7 +210,7 @@ PerlConfigRequire PXT/Apache24Config.pm
AuthType Basic
AuthName "RHN Org Admin Area"
PerlAuthenHandler PXT::ApacheAuth
- require valid-user
+ require acl user_authenticated()
</Directory>
<Directory "/var/www/html/network/systems/ssm">
@@ -267,7 +267,7 @@ PerlConfigRequire PXT/Apache24Config.pm
AuthType Basic
AuthName "RHN Org Admin Area"
PerlAuthenHandler PXT::ApacheAuth
- require valid-user
+ require acl user_authenticated()
DirectoryIndex index.pxt
Options -Indexes
</Directory>
commit e351e94f1bbafe1d4d71481abb57ad1a0be4acf7
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 13:40:05 2013 +0100
make pxt ACL work in apache 2.4
diff --git a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
index 4b5a937..7c2e787 100644
--- a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
+++ b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
@@ -114,9 +114,7 @@ PerlModule PXT::ApacheHandler
PerlModule PXT::ApacheAuth
<IfVersion >= 2.4>
- <AuthzProviderAlias user acl>
- PerlAuthenHandler PXT::ApacheAuth
- </AuthzProviderAlias>
+PerlConfigRequire PXT/Apache24Config.pm
</IfVersion>
<Directory "/var/www/html/network/systems">
diff --git a/web/modules/pxt/PXT/Apache24Config.pm
b/web/modules/pxt/PXT/Apache24Config.pm
new file mode 100644
index 0000000..8844fd4
--- /dev/null
+++ b/web/modules/pxt/PXT/Apache24Config.pm
@@ -0,0 +1,62 @@
+#
+# Copyright (c) 2013 Red Hat, Inc.
+#
+# This software is licensed to you under the GNU General Public License,
+# version 2 (GPLv2). There is NO WARRANTY for this software, express or
+# implied, including the implied warranties of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+# along with this software; if not, see
+#
http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+#
+# Red Hat trademarks are not licensed under GPLv2. No permission is
+# granted to use or replicate Red Hat trademarks that are incorporated
+# in this software or its documentation.
+#
+
+use strict;
+
+package PXT::Apache24Config;
+
+use Apache2::Util ();
+use Apache2::Provider ();
+use Apache2::RequestUtil ();
+use Apache2::ServerUtil ();
+use Apache2::ServerRec ();
+use Apache2::Process ();
+use Apache2::Const qw/:common AUTHZ_PROVIDER_VERSION AUTHZ_PROVIDER_GROUP
+ AUTH_INTERNAL_PER_CONF
+ AUTHZ_GRANTED AUTHZ_DENIED OK/;
+use PXT::ApacheAuth;
+
+Apache2::RequestUtil::register_auth_provider(
+ Apache2::ServerUtil->server->process->pool,
+ Apache2::Const::AUTHZ_PROVIDER_GROUP, "acl",
+ Apache2::Const::AUTHZ_PROVIDER_VERSION,
+ \&acl_check_authorization,
+ \&parse_require_line,
+ Apache2::Const::AUTH_INTERNAL_PER_CONF);
+
+sub parse_require_line {
+ my $parms = shift; # Apache2::CmdParms
+ my $require_line = shift;
+
+ # Return non-empty string if there is an error in require_line, othewise
+ # return empty string.
+ # acl could be any string, we check syntax in runtime
+ return "";
+}
+
+sub acl_check_authorization {
+ my $r = shift;
+ my $require_args = shift;
+
+ # print acl to log.
+ #$r->log_error($require_args);
+ PXT::ApacheAuth::handler($r);
+ return (PXT::ApacheAuth::authz_handler($r, "acl $require_args") ==
Apache2::Const::OK ?
+ Apache2::Const::AUTHZ_GRANTED : Apache2::Const::AUTHZ_DENIED);
+
+}
+
+
+1;
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 969c746..9a61861 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -100,6 +100,7 @@ sub handler {
sub authz_handler {
my $r = shift;
+ my $acl_require = shift; # apache 2.4
return OK if $r->main;
@@ -110,7 +111,8 @@ sub authz_handler {
my $session = $r->pnotes('pxt_session');
my $pxt = $r->pnotes('pxt_request');
- my @requires = map {$_->{requirement}} @{$r->requires};
+ my @requires = ($acl_require ? ($acl_require)
+ : map {$_->{requirement}} @{$r->requires});
my ($reqs, $passes);
commit 8b1c07b70e92579f87c9d00a0b46d1c7b023f3d4
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 13:27:00 2013 +0100
simplify @requires list
diff --git a/web/modules/pxt/PXT/ApacheAuth.pm b/web/modules/pxt/PXT/ApacheAuth.pm
index 1dc4fbe..969c746 100644
--- a/web/modules/pxt/PXT/ApacheAuth.pm
+++ b/web/modules/pxt/PXT/ApacheAuth.pm
@@ -110,12 +110,12 @@ sub authz_handler {
my $session = $r->pnotes('pxt_session');
my $pxt = $r->pnotes('pxt_request');
- my @requires = @{$r->requires};
+ my @requires = map {$_->{requirement}} @{$r->requires};
my ($reqs, $passes);
foreach my $entry (@requires) {
- my ($type, $string) = split /\s+/, $entry->{requirement}, 2;
+ my ($type, $string) = split /\s+/, $entry, 2;
$reqs++;
if ($type eq 'valid-user') {
@@ -125,7 +125,7 @@ sub authz_handler {
# support addition mixin'able acls directly from the .htaccess file...
my @mixins;
- while ($entry->{requirement} =~ m/mixin\s+(.*?)\s+/g) {
+ while ($entry =~ m/mixin\s+(.*?)\s+/g) {
push @mixins, $1;
}
commit 8515b060e076f7bfa7f333e864ff3781538de835
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Fri Feb 8 12:24:53 2013 +0100
put requires for single file/directory to one line
to simplify apache 2.4 configuration
diff --git a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
index b064618..4b5a937 100644
--- a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
+++ b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
@@ -149,22 +149,19 @@ PerlModule PXT::ApacheAuth
<Files admin_list.pxt>
AuthType Basic
AuthName "RHN System Group Admin Area"
- require acl user_role(system_group_admin)
- require acl user_has_access_to_servergroup()
+ require acl user_role(system_group_admin); user_has_access_to_servergroup()
</Files>
<Files delete_confirm.pxt>
AuthType Basic
AuthName "RHN System Group Admin Area"
- require acl user_role(system_group_admin)
- require acl user_has_access_to_servergroup()
+ require acl user_role(system_group_admin); user_has_access_to_servergroup()
</Files>
<Files edit_properties.pxt>
AuthType Basic
AuthName "RHN System Group Admin Area"
- require acl user_role(system_group_admin)
- require acl user_has_access_to_servergroup()
+ require acl user_role(system_group_admin); user_has_access_to_servergroup()
</Files>
<Files errata_list.pxt>
commit 36a8fd5b427c90e15f02b9685f4538b97cedd455
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Mon Feb 4 16:34:10 2013 +0100
removed lost files we are not packing for ages
diff --git a/monitoring/SputLite/html/cgi-bin/.htaccess
b/monitoring/SputLite/html/cgi-bin/.htaccess
deleted file mode 100644
index 8a06ba6..0000000
--- a/monitoring/SputLite/html/cgi-bin/.htaccess
+++ /dev/null
@@ -1 +0,0 @@
-Options ExecCGI FollowSymLinks Indexes
diff --git a/monitoring/SputLite/html/cgi-bin/.new
b/monitoring/SputLite/html/cgi-bin/.new
deleted file mode 100644
index 1e8b314..0000000
--- a/monitoring/SputLite/html/cgi-bin/.new
+++ /dev/null
@@ -1 +0,0 @@
-6
commit 3d2169e37b606b8a1c39e81ade748f9c21bdfb76
Author: Michael Mraka <michael.mraka(a)redhat.com>
Date: Mon Feb 4 16:24:23 2013 +0100
merged .htaccess to main httpd configuration
diff --git a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
index e7ad1c4..b064618 100644
--- a/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
+++ b/spacewalk/config/etc/httpd/conf.d/zz-spacewalk-www.conf
@@ -119,6 +119,14 @@ PerlModule PXT::ApacheAuth
</AuthzProviderAlias>
</IfVersion>
+<Directory "/var/www/html/network/systems">
+ <Files system_list>
+ ForceType text/pxt
+ SetHandler perl-script
+ PerlHandler PXT::ApacheHandler
+ </Files>
+</Directory>
+
<Directory "/var/www/html/network/systems/groups">
AuthType Basic
AuthName "RHN System Group List"
diff --git a/web/html/network/systems/.htaccess b/web/html/network/systems/.htaccess
deleted file mode 100644
index ebeb0af..0000000
--- a/web/html/network/systems/.htaccess
+++ /dev/null
@@ -1,6 +0,0 @@
-<Files system_list>
- ForceType text/pxt
- SetHandler perl-script
- PerlModule PXT::ApacheHandler
- PerlHandler PXT::ApacheHandler
-</Files>