Important Advice against Google Bot

[Emilio Sanchez]

Hello guys,

Two weeks ago Google Bot has scratched my web site by pointing to /setup relative link that i didn't know.

No link on internet pointed to this relative link however.

I advice you really install next version 1.0.2 in which the default site setup will only be done 

through configuration panel in backoffice.

regards

[Emanuele Ziglioli]

That's a worry! Are you saying that under the old version, anybody can hit /setup and reset the site??
That should have gone under a protected /_ah url!
I'll have a look at the new version

[Emanuele Ziglioli]

I've just checked our web.xml

 <security-constraint>

 <web-resource-collection>

 <web-resource-name></web-resource-name>

 <url-pattern>/setup</url-pattern>

 </web-resource-collection>

 <auth-constraint>

 <role-name>admin</role-name>

 </auth-constraint>

 </security-constraint>

that should be enough to protect the site from a bot but not enough to protect an authorized user from hitting that url.

What are the consequences?

[Emanuele Ziglioli]

I suppose in production one could simply disable the init and the update filters

 <filter>

 <filter-name>InitFilter</filter-name>

 <filter-class>org.vosao.filter.InitFilter</filter-class>

 </filter>

 <filter-mapping>

 <filter-name>InitFilter</filter-name>

 <url-pattern>/*</url-pattern>

 </filter-mapping>

[Emilio Sanchez]

Yeah the InitFilter code must be modified in order to erase /setup entry

[Emilio Sanchez]

What do you think ?

This "bug" has been there since the beginning. Well the former developpers were pretty confident

[Emanuele Ziglioli]

Yeah, I've disabled it in production. Perhaps we could add a check on the source address (it could be local, for testing, 127...).

Or another check to make sure we don't erase an existing site by mistake.

Did you lose important stuff?

[Lystochok Osinniy]

Was this issue posted on:
https://github.com/vosaocms/vosao/issues
I couldn't find it.
Is it planned to be fixed? Or is it documented somewhere that manual disabling of InitFilter is required?
How it should be done? Just remove it?

[Emilio Sanchez]

A 1.0.2 version will soon be downloadable from Vosao Google Drive

[Emilio Sanchez]

and fix the problem (new issue to be created) : /setup will be erased

[Emilio Sanchez]

Hello guys,

#607 issue "/setup security lack" 

was created