kallithea Changeset - 8e26c46e9abe

Changeset - 8e26c46e9abe

Parent rev.

Child rev.

[Not reviewed]

default

0 5 0

Mads Kiilerich - 11 years ago 2014-08-12 13:08:23
madski@unity3d.com

https: introduce https_fixup config setting to enable the special https hacks

Without https_fixup, correctly configured WSGI systems work correctly.

The https_fixup middleware will only be loaded when enabled in the configuration.

5 files changed with 19 insertions and 16 deletions:

docs/setup.rst

kallithea/config/middleware.py

kallithea/lib/base.py

kallithea/lib/middleware/simplegit.py

kallithea/lib/middleware/simplehg.py

0 comments (0 inline, 0 general)

docs/setup.rst

➞

Show inline comments

@@ @@ -511,19 +511,21 @@ In order to start using celery run:: @@
    Make sure you run this command from the same virtualenv, and with the same
    user that Kallithea runs.
 HTTPS support
 -------------
 There are two ways to enable https:
 Kallithea will by default generate URLs based on the WSGI environment.
 Alternatively, you can use some special configuration settings to control
 directly which scheme/protocol Kallithea will use when generating URLs:
 - Set HTTP_X_URL_SCHEME in your http server headers, than Kallithea will
   recognize this headers and make proper https redirections
 - Alternatively, change the `force_https = true` flag in the ini configuration
   to force using https, no headers are needed than to enable https
 - With `https_fixup = true`, the scheme will be taken from the HTTP_X_URL_SCHEME,
   HTTP_X_FORWARDED_SCHEME or HTTP_X_FORWARDED_PROTO HTTP header (default 'http').
 - With `force_https = true` the default will be 'https'.
 - With `use_htsts = true`, it will set Strict-Transport-Security when using https.
 Nginx virtual host example
 --------------------------
 Sample config for nginx using proxy::

kallithea/config/middleware.py

➞

Show inline comments

@@ @@ -89,13 +89,14 @@ def make_app(global_conf, full_stack=Tru @@
         if asbool(config['debug']):
             app = StatusCodeRedirect(app)
         else:
             app = StatusCodeRedirect(app, [400, 401, 403, 404, 500])
     #enable https redirets based on HTTP_X_URL_SCHEME set by proxy
     app = HttpsFixup(app, config)
     if any(asbool(config.get(x)) for x in ['https_fixup', 'force_ssl', 'use_htsts']):
         app = HttpsFixup(app, config)
     # Establish the Registry for this application
     app = RegistryManager(app)
     if asbool(static_files):
         # Serve static files

kallithea/lib/base.py

➞

Show inline comments

@@ @@ -210,24 +210,24 @@ class BaseVCSController(object): @@
         return True
     def _get_ip_addr(self, environ):
         return _get_ip_addr(environ)
-    def _check_ssl(self, environ, start_response):
     def _check_ssl(self, environ):
         """
         Checks the SSL check flag and returns False if SSL is not present
         and required True otherwise
         """
         org_proto = environ['wsgi._org_proto']
         #check if we have SSL required  ! if not it's a bad request !
         require_ssl = str2bool(Ui.get_by_key('push_ssl').ui_value)
         if require_ssl and org_proto == 'http':
             log.debug('proto is %s and SSL is required BAD REQUEST !'
                       % org_proto)
             return False
         if str2bool(Ui.get_by_key('push_ssl').ui_value):
             org_proto = environ.get('wsgi._org_proto', environ['wsgi.url_scheme'])
             if org_proto != 'https':
                 log.debug('proto is %s and SSL is required BAD REQUEST !'
                           % org_proto)
                 return False
         return True
     def _check_locking_state(self, environ, action, repo, user_id):
         """
         Checks locking on this repository, if locking is enabled and lock is
         present returns a tuple of make_lock, locked, locked_by.

kallithea/lib/middleware/simplegit.py

➞

Show inline comments

@@ @@ -63,13 +63,13 @@ def is_git(environ): @@
 class SimpleGit(BaseVCSController):
     def _handle_request(self, environ, start_response):
         if not is_git(environ):
             return self.application(environ, start_response)
-        if not self._check_ssl(environ, start_response):
         if not self._check_ssl(environ):
             return HTTPNotAcceptable('SSL REQUIRED !')(environ, start_response)
         ip_addr = self._get_ip_addr(environ)
         username = None
         self._git_first_op = False
         # skip passing error to error controller

kallithea/lib/middleware/simplehg.py

➞

Show inline comments

@@ @@ -68,13 +68,13 @@ def is_mercurial(environ): @@
 class SimpleHg(BaseVCSController):
     def _handle_request(self, environ, start_response):
         if not is_mercurial(environ):
             return self.application(environ, start_response)
-        if not self._check_ssl(environ, start_response):
         if not self._check_ssl(environ):
             return HTTPNotAcceptable('SSL REQUIRED !')(environ, start_response)
         ip_addr = self._get_ip_addr(environ)
         username = None
         # skip passing error to error controller
         environ['pylons.status_code_redirect'] = True

0 comments (0 inline, 0 general)