Changeset 32430

Timestamp:

2018-09-06T22:34:17+12:00 (5 years ago)

Author:

ak19

Message:

solr should only be accessible locally (from localhost, specifically 127.0.0.1) which means over http. This conflicted with the previous design of the properties file for working with http and/or https. Now we have tomcat.port.https and localhost.port.http, both always set. In place of server.protocol that used to contain the default protocol, we now have server.protocols which can be set to a comma separated list of one or both of http and https. Drastic restructuring followed. I think I've tested all but https certification stuff.

Location:

gs3-extensions/solr/trunk/src/src/java/org/greenstone/gsdl3/service

Files:

• GS2SolrSearch.java (modified) (2 diffs)
• SolrSearch.java (modified) (2 diffs)

gs3-extensions/solr/trunk/src/src/java/org/greenstone/gsdl3/service/GS2SolrSearch.java

@@ -96 +96 @@
             Properties globalProperties = new Properties();
             globalProperties.load(Class.forName("org.greenstone.util.GlobalProperties").getClassLoader().getResourceAsStream("global.properties"));
+            
+            /*
             String host = globalProperties.getProperty("tomcat.server", "localhost");
             //String port = globalProperties.getProperty("tomcat.port.http", "8383");
@@ -107 +109 @@
             String portStr = port.equals("80") ? "" : ":"+port;
             solr_servlet_base_url = protocol+"://"+host+portStr+"/"+solrContext;
+            */
+
+            // The solr servlet is only accessible locally (from "localhost",  specifically 127.0.0.1).
+            // for security reasons, as we don't want non librarian users
+            // to go to the solr servlet and delete solr cores or something.
+            // The security Valve element in the tomcat solr.xml context file restricts
+            // access to 127.0.0.1, but here we ensure that the solr URL is the local http one
+            // and not any https with domain name and https port.
+            // Note that we use 127.0.0.1 instead of literally "localhost" since localhost is unsafe
+            ProtocolPortProperties protocolPortProps = new ProtocolPortProperties(globalProperties); // can throw Exception
+            String solrContext = globalProperties.getProperty("solr.context", "solr");
+            solr_servlet_base_url = protocolPortProps.getLocalHttpBaseAddress()+"/"+solrContext;
+
         } catch(Exception e) {
             logger.error("Error reading greenstone's tomcat solr server properties from global.properties", e);

gs3-extensions/solr/trunk/src/src/java/org/greenstone/gsdl3/service/SolrSearch.java

@@ -46 +46 @@
         Properties globalProperties = new Properties();
         globalProperties.load(Class.forName("org.greenstone.util.GlobalProperties").getClassLoader().getResourceAsStream("global.properties"));
+
+        /*
         String host = globalProperties.getProperty("tomcat.server", "localhost");
         //String port = globalProperties.getProperty("tomcat.port.http", "8383");
@@ -56 +58 @@
         String portStr = port.equals("80") ? "" : ":"+port;
         solr_servlet_base_url = protocol+"://"+host+portStr+"/"+solrContext;
+        */
+
+        // The solr servlet is only accessible locally (from "localhost",  specifically 127.0.0.1).
+        // for security reasons, as we don't want non librarian users
+        // to go to the solr servlet and delete solr cores or something.
+        // The security Valve element in the tomcat solr.xml context file restricts
+        // access to 127.0.0.1, but here we ensure that the solr URL is the local http one
+        // and not any https with domain name and https port.
+        // Note that we use 127.0.0.1 instead of literally "localhost" since localhost is unsafe
+        ProtocolPortProperties protocolPortProps = new ProtocolPortProperties(globalProperties); // can throw an Exception
+        String solrContext = globalProperties.getProperty("solr.context", "solr");
+        solr_servlet_base_url = protocolPortProps.getLocalHttpBaseAddress()+"/"+solrContext;
     } catch(Exception e) {
         logger.error("Error reading greenstone's tomcat solr server properties from global.properties", e);