186383 - Checksetup leaves editor backups of localconfig accessible

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect, P1)

Description

[Joel Peshkin]

Any user who uses vim will have files such as localconfig~ which are left
accessible.

Comment 1

[Bradley Baetz (:bbaetz)]

I just fixed this for bugzilla-stable on landfill...

We _so_ need to move all of this stuff out of the webtree, but I don't think we
have the infrastructure yet for that.

Comment 2

[Joel Peshkin]

Attachment: Patch for new sites

This is a change to checksetup that causes it to write the right .htaccess file
in the first place

The problem, however, is that checksetup will only create the file if it
doesn't already exist.

Comment 3

[Joel Peshkin]

Actually, this should be done as a checksetup issue...

Comment 4

[Joel Peshkin]

Attachment: Patch including repair code

OK, this patch changes the .htaccess file from 
localconfig|nextfile
to
localconfig.*|nextfile
Which will work for anyone who let checksetup build .htaccess for them and runs
checksetup again.

Comment 5

[Joel Peshkin]

Attachment: Same patch for 2_16

Comment 6

[Joel Peshkin]

Attachment: Same patch for 2_14

Comment 7

[J. Paul Reed [:preed]]

It's a good thing I'm such a slacker and we haven't released yet... ;-)

Are we gonna fold this fix into the security announcement for 2.14.x/2.16.x, and
the three releases due out this weekend (2.14.5 and 2.16.2 and 2.17.2)? Justdave?

Bueller?

Bueller?

Comment 8

[Dave Miller [:justdave]]

yes, we'll hold release for this.

Comment 9

[Dave Miller [:justdave]]

make it so

Comment 10

[Joel Peshkin]

On HEAD:
 Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.212; previous revision: 1.211
done 

On BUGZILLA-2_14_1-BRANCH:
Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.99.2.2; previous revision: 1.99.2.1
done                                                      

On BUGZILLA-2_16-BRANCH :
Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.149.2.12; previous revision: 1.149.2.11
done                

                                     

Comment 11

[Joel Peshkin]

Attachment: Further patch for TIP.. only remove the ~

Comment 12

[Joel Peshkin]

Attachment: Further patch for 2.14

Comment 13

[Joel Peshkin]

OOPS forgot about localconfig.js must be accessable

Comment 14

[Joel Peshkin]

Attachment: Further patch for 2.14

Comment 15

[Gervase Markham [:gerv]]

Note that some editors use "~localconfig" or "#localconfig" or other schemes.

Surely it's the responsibility of an admin to configure their editor not to
leave backups of sensitive files lying around? :-)

Are we going to have to rename localconfig.js to make this work, or can we add
an exception for it?

Gerv

Comment 16

[J. Paul Reed [:preed]]

Ok... so are (yet again) holding the release for this?

There's a reason I put "released this weekend" in the status report... I wanted
to give us the flexibility for stuff like this. :-)

Comment 17

[Joel Peshkin]

Attachment: Replacement patch for TIP

This patch requires backing out the old patch first

This uses .*localconfig.*
but then countermands that in a subsequent block with an allow from all

Comment 18

[J. Paul Reed [:preed]]

Ok... just talked to joel on IRC, and I guess the checked in patch isn't good
enough; when this bug is closed again, with the proper fix checked in on all the
branches, I'll go ahead and retag all the releases, which I have to do anyway
because we forgot relnotes for 2.14.5 and 2.16.2.

Comment 19

[J. Paul Reed [:preed]]

Comment on attachment 109937 [details] [diff] [review]
Replacement patch for TIP

Tested on landfill w/ 2.17.2; looks good.

r=preed

Comment 20

[Joel Peshkin]

Attachment: Replacement patch for 2_16

Same for 2.16 
Back out prior patch first

Comment 21

[Joel Peshkin]

Attachment: Replacement patch for 2_14

Same story, back out prior patch first

Comment 22

[Tobias Burnus]

Comment on attachment 109938 [details] [diff] [review]
Replacement patch for 2_16

TIP version works ok, TIP/2.16/2.14 look ok and apply ok.

r=burnus

(Hopefully not to many have already run ./checksetup from tip, otherwise
localconfig.js is unavailable. Maybe
+    if ($oldaccess =~ s/\|localconfig\|/\|.*localconfig.*\|/) {
should be changed to
+    if ($oldaccess =~ s/\|localconfig(\.\|)?\|/\|.*localconfig.*\|/) {
At least I have run already the wrong update.)

Comment 23

[Dave Miller [:justdave]]

Comment on attachment 109937 [details] [diff] [review]
Replacement patch for TIP

Note that this patch will add the FilesMatch for allowing the .js and .rdf at
the end of the .htaccess file...  if a site is blocking IPs because of robots
or DOSes (like mothra), this will put the new check after those, thus allowing
the banned IPs to still access those files (because an "allow from all" was the
last match).  Probably doesn't matter a whole lot.  People who are maintaining
that type of thing can fix it themselves. :-)

Comment 24

[Joel Peshkin]

Fixed in all 3 branches (again)

Comment 25

[Joel Peshkin]

Public notice complete. Removing security flag.

Comment 26

[alan johnson]

lack of responce

Comment 27

[Dave Miller [:justdave]]

lack of response to what?  it's already fixed.

Comment 30

[Gulf Upload]

how Can i Add Profile ?
http://gulfupload.com/

Comment 31

[Printable Calendar]

(In reply to Joel Peshkin from comment #25)
> Public notice complete. Removing security flag.

factually that is not true that conneg is dead - the reference is an opinion piece and I've disagreed strongly in the past and still do.

content negotiation is used for webp (https://www.123calendars.com/), and (relatedly) brotli and makes a lot of sense for incremental deployment of new encodings.

with webp in particular, this is the expected way to do it (and is chrome compat - which should always be a goal right now) and I would rather strongly want us to add it.

Comment 32

[Printable Calendar]

Surely it's the responsibility of an admin to configure their editor not to
leave backups of sensitive files lying around? :-)

On BUGZILLA-2_14_1-BRANCH:
Checking in checksetup.pl;
/cvsroot/mozilla/webtools/bugzilla/checksetup.pl,v  <--  checksetup.pl
new revision: 1.99.2.2; previous revision: 1.99.2.1
done  

Which will work for anyone who let checksetup build .htaccess for them and runs
checksetup again.

Bueller?

https://freshcalendars.com/

Comment 33

[pejo]

TIP version works ok, TIP/2.16/2.14 look ok and apply ok.

r=burnus

(Hopefully not to many have already run ./checksetup from tip, otherwise
localconfig.js is unavailable. Maybe
+    if ($oldaccess =~ s/\|localconfig\|/\|.*localconfig.*\|/) {


Which will work for anyone who let checksetup build .htaccess for them and runs
checksetup again.

Bueller?

https://www.luxecalendar.com/

Comment 34

[celldwelltribe]

I have read your blog. I hope you continue to have such quality articles to share!
I would like to see you tackle the subject of getting older folks motivated, up and out to these sorts of activities.

https://celldwellertribe.com/kalender-april-2019/
https://celldwellertribe.com/calendario-abril-2019-para-imprimir/
https://celldwellertribe.com/calendario-mayo-2019-con-festivos/
https://celldwellertribe.com/calendrier-juillet-2019-a-imprimer/

Comment 35

[kushal]

https://bestsnowblowersreviews.com/two-stage-snow-blower/

Comment 36

[rekha]

Thanks for sharing such great information with us. Your Post is very unique and all information is reliable for new readers. Keep it up in future, thanks for sharing such a useful post.
https://homesecuritydevices.us/kalender-mai-2019/
https://homesecuritydevices.us/kalender-juni-2019-mit-feiertagen/
https://homesecuritydevices.us/calendario-junio-2019-argentina/
https://homesecuritydevices.us/calendario-junho-2019/

Comment 37

[romigupta]

this will put the new check after those, thus allowing
the banned IPs to still access those files (because an "allow from all" was the
last match). Probably doesn't matter a whole lot. People who are maintaining
that type of thing can fix it themselves https://calendardiy.com/

Comment 38

[info]

https://comparebestmove.com/ compare removals

Comment 39

[Nayra Sharma]

great solve the bug

Comment 40

[Yotan Chi]

I got this fixed for bugzilla stable. Do I need to Move all the data of the webtreee ? For Example : This Website (https://printthecalendar.com) is completely designed on Php 6 & I'm not able to see that this patch will get the changes in current .htaccess file from localconfig|nextfiletolocalconfig.*|nextfile.

Comment 41

[gamblingsitescanada]

tested on my gaming portal https://gamblingsitescanada.com looks perfect

Comment 42

[gamblingsitescanada]

https://gamblingsitescanada.com/ legit gambling sites