YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

nginx: use /var/www/.well-known folder for ynh diagnosis and acme challenge, because /tmp/ could be manipulated by user to serve maliciously crafted files

Browse source
This commit is contained in:
Alexandre Aubin 2023-06-09 22:30:32 +02:00
parent cec0dfe158
commit d42c99835a
4 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
conf/nginx/plain/acme-challenge.conf.inc
View file

@ -1,6 +1,6 @@
location ^~ '/.well-known/acme-challenge/'
{
default_type "text/plain";
alias /tmp/acme-challenge-public/;
alias /var/www/.well-known/acme-challenge-public/;
gzip off;
}

2
conf/nginx/server.tpl.conf
View file

@ -13,7 +13,7 @@ server {
include /etc/nginx/conf.d/acme-challenge.conf.inc;
location ^~ '/.well-known/ynh-diagnosis/' {
alias /tmp/.well-known/ynh-diagnosis/;
alias /var/www/.well-known/ynh-diagnosis/;
}
{% if mail_enabled == "True" %}

4
src/certificate.py
View file

@ -41,8 +41,8 @@ from yunohost.log import OperationLogger
logger = getActionLogger("yunohost.certmanager")
CERT_FOLDER = "/etc/yunohost/certs/"
TMP_FOLDER = "/tmp/acme-challenge-private/"
WEBROOT_FOLDER = "/tmp/acme-challenge-public/"
TMP_FOLDER = "/var/www/.well-known/acme-challenge-private/"
WEBROOT_FOLDER = "/var/www/.well-known/acme-challenge-public/"
SELF_CA_FILE = "/etc/ssl/certs/ca-yunohost_crt.pem"
ACCOUNT_KEY_FILE = "/etc/yunohost/letsencrypt_account.pem"

6
src/diagnosers/21-web.py
View file

@ -60,9 +60,9 @@ class MyDiagnoser(Diagnoser):
domains_to_check.append(domain)
self.nonce = "".join(random.choice("0123456789abcedf") for i in range(16))
rm("/tmp/.well-known/ynh-diagnosis/", recursive=True, force=True)
mkdir("/tmp/.well-known/ynh-diagnosis/", parents=True)
os.system("touch /tmp/.well-known/ynh-diagnosis/%s" % self.nonce)
rm("/var/www/.well-known/ynh-diagnosis/", recursive=True, force=True)
mkdir("/var/www/.well-known/ynh-diagnosis/", parents=True)
os.system("touch /var/www/.well-known/ynh-diagnosis/%s" % self.nonce)
if not domains_to_check:
return