Page MenuHomeGitPull.it
Create Task
Maniphest T619

Fix unintended HTTP Auth for LibreTime widgets
Closed, ResolvedPublic1 Points
Actions

Description

In T594 we have protected LibreTime with an HTTP Auth using an Apache frontend but this caused the unintentionally protection of all LibreTime widgets under the /embed base URL.

This is a nasty behavior because now a widget is embedded in the website causing the OAuth popup to visitors and consequent failure:

image.png (347×702 px, 112 KB)

We have not noticed this until today because this is what I was seeing. You know, "it works on my computer" because I'm already authenticated:

image.png (2×1 px, 1 MB)

Related Objects
Search...

Event Timeline

valerio.bozzolan created this task.Nov 27 2020, 19:28
valerio.bozzolan triaged this task as High priority.
Restricted Application edited projects, added User-valerio.bozzolan; removed User-valerio.bozzolan (Last week November 2020). · View Herald TranscriptNov 27 2020, 19:28
valerio.bozzolan closed this task as Resolved.Nov 27 2020, 19:30
valerio.bozzolan mentioned this in T594: Expose the new LibreTime virtual machine via Reyboz reyboz to director.border-radio.it.

See T594: Expose the new LibreTime virtual machine via Reyboz reyboz to director.border-radio.it for the updated Apache configuration.

valerio.bozzolan moved this task from Backlog to Last week November 2020 on the User-valerio.bozzolan board.Nov 27 2020, 19:32
valerio.bozzolan edited projects, added User-valerio.bozzolan (Last week November 2020); removed User-valerio.bozzolan.
valerio.bozzolan reopened this task as Open.Nov 28 2020, 12:55

This was not resolved for strange reasons.

valerio.bozzolan added a comment.Nov 28 2020, 13:04

We was forgetting the internal resources:

	# Allow everyone to see LibreTime widgets
	# https://gitpull.it/T619
	<Location "/embed/">
		AuthType none
		Require all granted
		Satisfy any
	</Location>

	# Allow everyone to see LibreTime widgets and its resources
	# https://gitpull.it/T619
	<Location "/js/">
		AuthType none
		Require all granted
		Satisfy any
	</Location>

	# Allow everyone to see LibreTime widgets and its resources
	# https://gitpull.it/T619
	<Location "/widgets/">
		AuthType none
		Require all granted
		Satisfy any
	</Location>

	# Allow everyone to see LibreTime widgets and its resources
	# https://gitpull.it/T619
	<Location "/css/">
		AuthType none
		Require all granted
		Satisfy any
	</Location>
valerio.bozzolan closed this task as Resolved.Nov 28 2020, 13:04
Public contents are in Creative Commons Attribution-ShareAlike 4.0 (CC-BY-SA) or GNU Free Documentation License (at your option) unless otherwise noted. · Contact / Register