Bug 1373067 - prevent directory listing on directories where it is not needed
Summary: prevent directory listing on directories where it is not needed
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite 5
Classification: Red Hat
Component: WebUI
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
Assignee: Ondrej Gajdusek
QA Contact: Pavel Studeník
URL:
Whiteboard:
Depends On:
Blocks: sat580-low
TreeView+ depends on / blocked
 
Reported: 2016-09-05 05:00 UTC by Jan Hutař
Modified: 2019-12-16 06:37 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-06-21 12:07:52 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Jan Hutař 2016-09-05 05:00:56 UTC 
Description of problem:
Although this is not a problem, would be nice and would look better in security scans if we prevent directory listing on directories where it is not needed


Version-Release number of selected component (if applicable):
Satellite 5.7.0


How reproducible:
always


Steps to Reproduce:
Check that following dirs are browse-able:
> http://<fqdn>/fonts/Roboto/
> http://<fqdn>/fonts/font-spacewalk/font/
> http://<fqdn>/img/nav/
> http://<fqdn>/img/i18n/
> http://<fqdn>/img/docs/
> http://<fqdn>/javascript/select2/
> http://<fqdn>/errors/
> http://<fqdn>/javascript/
> http://<fqdn>/img/
> http://<fqdn>/images/
> http://<fqdn>/css/
> http://<fqdn>/fonts/font-awesome/css/
> http://<fqdn>/fonts/font-awesome/
> http://<fqdn>/fonts/
> http://<fqdn>/fonts/font-spacewalk/css/
> http://<fqdn>/fonts/font-spacewalk/
> http://<fqdn>/fonts/font-awesome/fonts/


Actual results:
Apache generates directory listing for these


Expected results:
Apache does not generates directory listing for these
Comment 6 Ondrej Gajdusek 2016-11-01 09:46:20 UTC 
Fix available in upstream as 7899ff8f8aa289203383719edde0ff800084deb0 .
Apache will raise Permission Error from /var/www/html/errors now.
Comment 9 Ondrej Gajdusek 2016-11-11 10:14:22 UTC 
I did one-line fix in due to badly displayed fonts in the WebUI.
Spacewalk.git 82776f76af0ee05edf82e5fe876aa9410a12eaf9
Comment 11 Pavel Studeník 2017-05-25 12:16:21 UTC 
Forgot on directory http://<fqdn>/images/

Others list of files in directory were not shown.
Comment 14 Pavel Studeník 2017-05-29 10:10:57 UTC 
I created new bug 1456393 for Insights plug-in.

And I verified the bug with package spacewalk-config-2.6.0-3.el6sat.noarch
Note You need to log in before you can comment on or make changes to this bug.