From 822c322d20d12f81c6cfca47b66f900542a5aac2 Mon Sep 17 00:00:00 2001 From: James Valleroy Date: Wed, 26 Aug 2020 09:40:36 -0400 Subject: [PATCH] apache: Disable mod_status Prevent leaking private info through Tor onion service or Pagekite. Tests: - When starting plinth, apache setup is run. Status module is disabled, and apache2 is restarted. - sunil: After upgrade, status page is not available. - sunil: mod_status is available in stable (2.4.38-3+deb10u3) and testing/unstable (2.4.46-1). Closes: #1935. Signed-off-by: James Valleroy Reviewed-by: Sunil Mohan Adapa Tested-by: Sunil Mohan Adapa --- actions/apache | 3 +++ plinth/modules/apache/__init__.py | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/actions/apache b/actions/apache index 9dbe9d957..a888acac9 100755 --- a/actions/apache +++ b/actions/apache @@ -117,6 +117,9 @@ def subcommand_setup(arguments): webserver.enable('rewrite', kind='module') webserver.enable('macro', kind='module') + # Disable /server-status page to avoid leaking private info. + webserver.disable('status', kind='module') + # switch to mod_ssl from mod_gnutls webserver.disable('gnutls', kind='module') webserver.enable('ssl', kind='module') diff --git a/plinth/modules/apache/__init__.py b/plinth/modules/apache/__init__.py index 2826ed558..21567731c 100644 --- a/plinth/modules/apache/__init__.py +++ b/plinth/modules/apache/__init__.py @@ -13,7 +13,7 @@ from plinth.modules.firewall.components import Firewall from plinth.modules.letsencrypt.components import LetsEncrypt from plinth.utils import format_lazy -version = 7 +version = 8 is_essential = True