apache: Disable mod_status

Prevent leaking private info through Tor onion service or Pagekite.

Tests:

- When starting plinth, apache setup is run. Status module is
disabled, and apache2 is restarted.

- sunil: After upgrade, status page is not available.

- sunil: mod_status is available in stable (2.4.38-3+deb10u3) and
testing/unstable (2.4.46-1).

Closes: #1935.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tested-by: Sunil Mohan Adapa <sunil@medhas.org>

actions/apache

@@ -117,6 +117,9 @@ def subcommand_setup(arguments):
         webserver.enable('rewrite', kind='module')
         webserver.enable('macro', kind='module')
 
+        # Disable /server-status page to avoid leaking private info.
+        webserver.disable('status', kind='module')
+
         # switch to mod_ssl from mod_gnutls
         webserver.disable('gnutls', kind='module')
         webserver.enable('ssl', kind='module')

plinth/modules/apache/__init__.py

@@ -13,7 +13,7 @@ from plinth.modules.firewall.components import Firewall
 from plinth.modules.letsencrypt.components import LetsEncrypt
 from plinth.utils import format_lazy
 
-version = 7
+version = 8
 
 is_essential = True