Changeset 37741 for main

Timestamp:

2023-05-09T16:26:58+12:00 (12 months ago)

Author:

davidb

Message:

Updated to specify the RewriteValve, so we can have a rewrite.config file in web/WEB-INF/ that monitors for (and disables by default) Open Redirect calls using GS3 href= argument; this update can be used as a 'hot-fix' to prevent these sorts of redirects on an existing GS3 install using Tomcat8

File:

• main/trunk/greenstone3/resources/tomcat/greenstone3.xml.svn (modified) (1 diff)

main/trunk/greenstone3/resources/tomcat/greenstone3.xml.svn

@@ -60 +60 @@
          https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html -->
     <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="@allowedIPs@"/>
+
+    <!-- Allows us to include the file rewrite.config in web/WEB-INF
+         Currently used (by default) to monitor for GS3 DL calls that use:
+           &href=...
+         and disable them, as malicieous users can uses this to mount an Open Redirect attack -->
+    <Valve className="org.apache.catalina.valves.rewrite.RewriteValve"/>
+    
 </Context>