Changeset - c394a564ab71
[Not reviewed]
beta
0 4 0
Marcin Kuzminski - 13 years ago 2013-02-10 20:35:35
marcin@python-works.com
make the htsts headers optional and stored in .ini file.
also don't use it with DEBUG
4 files changed with 16 insertions and 2 deletions:
0 comments (0 inline, 0 general)
development.ini
Show inline comments
 
@@ -21,97 +21,100 @@ pdebug = false
 

	
 
#smtp_server = mail.server.com
 
#smtp_username = 
 
#smtp_password = 
 
#smtp_port = 
 
#smtp_use_tls = false
 
#smtp_use_ssl = true
 
# Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
 
#smtp_auth = 
 

	
 
[server:main]
 
## PASTE
 
##nr of threads to spawn
 
#threadpool_workers = 5
 

	
 
##max request before thread respawn
 
#threadpool_max_requests = 10
 

	
 
##option to use threads of process
 
#use_threadpool = true
 

	
 
#use = egg:Paste#http
 

	
 
#WAITRESS
 
threads = 5
 
use = egg:waitress#main
 

	
 
host = 0.0.0.0
 
port = 5000
 

	
 
[filter:proxy-prefix]
 
# prefix middleware for rc
 
use = egg:PasteDeploy#prefix
 
prefix = /<your-prefix>
 

	
 
[app:main]
 
use = egg:rhodecode
 
#filter-with = proxy-prefix
 
full_stack = true
 
static_files = true
 
# Optional Languages
 
# en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 
lang = en
 
cache_dir = %(here)s/data
 
index_dir = %(here)s/data/index
 
app_instance_uuid = rc-develop
 
cut_off_limit = 256000
 
vcs_full_cache = True
 
# force https in RhodeCode, fixes https redirects, assumes it's always https
 
force_https = false
 
# use Strict-Transport-Security headers
 
use_htsts = false
 
commit_parse_limit = 25
 
# number of items displayed in lightweight dashboard before paginating
 
dashboard_items = 100
 
use_gravatar = true
 

	
 
## RSS feed options
 

	
 
rss_cut_off_limit = 256000
 
rss_items_per_page = 10
 
rss_include_diff = false
 

	
 

	
 
## alternative_gravatar_url allows you to use your own avatar server application
 
## the following parts of the URL will be replaced
 
## {email}        user email
 
## {md5email}     md5 hash of the user email (like at gravatar.com)
 
## {size}         size of the image that is expected from the server application
 
## {scheme}       http/https from RhodeCode server
 
## {netloc}       network location from RhodeCode server
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}
 

	
 
container_auth_enabled = false
 
proxypass_auth_enabled = false
 
## default encoding used to convert from and to unicode
 
## can be also a comma seperated list of encoding in case of mixed encodings
 
default_encoding = utf8
 

	
 
## overwrite schema of clone url
 
## available vars:
 
## scheme - http/https
 
## user - current user
 
## pass - password 
 
## netloc - network location
 
## path - usually repo_name
 

	
 
#clone_uri = {scheme}://{user}{pass}{netloc}{path}
 

	
 
## issue tracking mapping for commits messages
 
## comment out issue_pat, issue_server, issue_prefix to enable
 

	
 
## pattern to get the issues from commit messages
 
## default one used here is #<numbers> with a regex passive group for `#`
 
## {id} will be all groups matched from this pattern
 

	
 
issue_pat = (?:\s*#)(\d+)
 

	
 
## server url to the issue, each {id} will be replaced with match
production.ini
Show inline comments
 
@@ -21,97 +21,100 @@ pdebug = false
 

	
 
#smtp_server = mail.server.com
 
#smtp_username = 
 
#smtp_password = 
 
#smtp_port = 
 
#smtp_use_tls = false
 
#smtp_use_ssl = true
 
# Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
 
#smtp_auth = 
 

	
 
[server:main]
 
## PASTE
 
##nr of threads to spawn
 
#threadpool_workers = 5
 

	
 
##max request before thread respawn
 
#threadpool_max_requests = 10
 

	
 
##option to use threads of process
 
#use_threadpool = true
 

	
 
#use = egg:Paste#http
 

	
 
#WAITRESS
 
threads = 5
 
use = egg:waitress#main
 

	
 
host = 127.0.0.1
 
port = 8001
 

	
 
[filter:proxy-prefix]
 
# prefix middleware for rc
 
use = egg:PasteDeploy#prefix
 
prefix = /<your-prefix>
 

	
 
[app:main]
 
use = egg:rhodecode
 
#filter-with = proxy-prefix
 
full_stack = true
 
static_files = true
 
# Optional Languages
 
# en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 
lang = en
 
cache_dir = %(here)s/data
 
index_dir = %(here)s/data/index
 
app_instance_uuid = rc-production
 
cut_off_limit = 256000
 
vcs_full_cache = True
 
# force https in RhodeCode, fixes https redirects, assumes it's always https
 
force_https = false
 
# use Strict-Transport-Security headers
 
use_htsts = false
 
commit_parse_limit = 50
 
# number of items displayed in lightweight dashboard before paginating
 
dashboard_items = 100
 
use_gravatar = true
 

	
 
## RSS feed options
 

	
 
rss_cut_off_limit = 256000
 
rss_items_per_page = 10
 
rss_include_diff = false
 

	
 

	
 
## alternative_gravatar_url allows you to use your own avatar server application
 
## the following parts of the URL will be replaced
 
## {email}        user email
 
## {md5email}     md5 hash of the user email (like at gravatar.com)
 
## {size}         size of the image that is expected from the server application
 
## {scheme}       http/https from RhodeCode server
 
## {netloc}       network location from RhodeCode server
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}
 

	
 
container_auth_enabled = false
 
proxypass_auth_enabled = false
 
## default encoding used to convert from and to unicode
 
## can be also a comma seperated list of encoding in case of mixed encodings
 
default_encoding = utf8
 

	
 
## overwrite schema of clone url
 
## available vars:
 
## scheme - http/https
 
## user - current user
 
## pass - password 
 
## netloc - network location
 
## path - usually repo_name
 

	
 
#clone_uri = {scheme}://{user}{pass}{netloc}{path}
 

	
 
## issue tracking mapping for commits messages
 
## comment out issue_pat, issue_server, issue_prefix to enable
 

	
 
## pattern to get the issues from commit messages
 
## default one used here is #<numbers> with a regex passive group for `#`
 
## {id} will be all groups matched from this pattern
 

	
 
issue_pat = (?:\s*#)(\d+)
 

	
 
## server url to the issue, each {id} will be replaced with match
rhodecode/config/deployment.ini_tmpl
Show inline comments
 
@@ -21,97 +21,100 @@ pdebug = false
 

	
 
#smtp_server = mail.server.com
 
#smtp_username = 
 
#smtp_password = 
 
#smtp_port = 
 
#smtp_use_tls = false
 
#smtp_use_ssl = true
 
# Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
 
#smtp_auth = 
 

	
 
[server:main]
 
## PASTE
 
##nr of threads to spawn
 
#threadpool_workers = 5
 

	
 
##max request before thread respawn
 
#threadpool_max_requests = 10
 

	
 
##option to use threads of process
 
#use_threadpool = true
 

	
 
#use = egg:Paste#http
 

	
 
#WAITRESS
 
threads = 5
 
use = egg:waitress#main
 

	
 
host = 127.0.0.1
 
port = 5000
 

	
 
[filter:proxy-prefix]
 
# prefix middleware for rc
 
use = egg:PasteDeploy#prefix
 
prefix = /<your-prefix>
 

	
 
[app:main]
 
use = egg:rhodecode
 
#filter-with = proxy-prefix
 
full_stack = true
 
static_files = true
 
# Optional Languages
 
# en, fr, ja, pt_BR, zh_CN, zh_TW, pl
 
lang = en
 
cache_dir = %(here)s/data
 
index_dir = %(here)s/data/index
 
app_instance_uuid = ${app_instance_uuid}
 
cut_off_limit = 256000
 
vcs_full_cache = True
 
# force https in RhodeCode, fixes https redirects, assumes it's always https
 
force_https = false
 
# use Strict-Transport-Security headers
 
use_htsts = false
 
commit_parse_limit = 50
 
# number of items displayed in lightweight dashboard before paginating
 
dashboard_items = 100
 
use_gravatar = true
 

	
 
## RSS feed options
 

	
 
rss_cut_off_limit = 256000
 
rss_items_per_page = 10
 
rss_include_diff = false
 

	
 

	
 
## alternative_gravatar_url allows you to use your own avatar server application
 
## the following parts of the URL will be replaced
 
## {email}        user email
 
## {md5email}     md5 hash of the user email (like at gravatar.com)
 
## {size}         size of the image that is expected from the server application
 
## {scheme}       http/https from RhodeCode server
 
## {netloc}       network location from RhodeCode server
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}
 

	
 
container_auth_enabled = false
 
proxypass_auth_enabled = false
 
## default encoding used to convert from and to unicode
 
## can be also a comma seperated list of encoding in case of mixed encodings
 
default_encoding = utf8
 

	
 
## overwrite schema of clone url
 
## available vars:
 
## scheme - http/https
 
## user - current user
 
## pass - password 
 
## netloc - network location
 
## path - usually repo_name
 

	
 
#clone_uri = {scheme}://{user}{pass}{netloc}{path}
 

	
 
## issue tracking mapping for commits messages
 
## comment out issue_pat, issue_server, issue_prefix to enable
 

	
 
## pattern to get the issues from commit messages
 
## default one used here is #<numbers> with a regex passive group for `#`
 
## {id} will be all groups matched from this pattern
 

	
 
issue_pat = (?:\s*#)(\d+)
 

	
 
## server url to the issue, each {id} will be replaced with match
rhodecode/lib/middleware/https_fixup.py
Show inline comments
 
# -*- coding: utf-8 -*-
 
"""
 
    rhodecode.lib.middleware.https_fixup
 
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

	
 
    middleware to handle https correctly
 

	
 
    :created_on: May 23, 2010
 
    :author: marcink
 
    :copyright: (C) 2010-2012 Marcin Kuzminski <marcin@python-works.com>
 
    :license: GPLv3, see COPYING for more details.
 
"""
 
# This program is free software: you can redistribute it and/or modify
 
# it under the terms of the GNU General Public License as published by
 
# the Free Software Foundation, either version 3 of the License, or
 
# (at your option) any later version.
 
#
 
# This program is distributed in the hope that it will be useful,
 
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
# GNU General Public License for more details.
 
#
 
# You should have received a copy of the GNU General Public License
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 

	
 
from pylons.controllers.util import Request
 
from rhodecode.lib.utils2 import str2bool
 

	
 

	
 
class HttpsFixup(object):
 

	
 
    def __init__(self, app, config):
 
        self.application = app
 
        self.config = config
 

	
 
    def __call__(self, environ, start_response):
 
        self.__fixup(environ)
 
        req = Request(environ)
 
        debug = str2bool(self.config.get('debug'))
 
        if str2bool(self.config.get('use_htsts')) and not debug:
 
            req = Request(environ, self.application)
 
        resp = req.get_response(self.application)
 
        if environ['wsgi.url_scheme'] == 'https':
 
            resp.headers['Strict-Transport-Security'] = 'max-age=8640000; includeSubDomains'
 
                resp.headers['Strict-Transport-Security'] = \
 
                    'max-age=8640000; includeSubDomains'
 
        return resp(environ, start_response)
 

	
 
        return self.application(environ, start_response)
 

	
 
    def __fixup(self, environ):
 
        """
 
        Function to fixup the environ as needed. In order to use this
 
        middleware you should set this header inside your
 
        proxy ie. nginx, apache etc.
 
        """
 
        # DETECT PROTOCOL !
 
        if 'HTTP_X_URL_SCHEME' in environ:
 
            proto = environ.get('HTTP_X_URL_SCHEME')
 
        elif 'HTTP_X_FORWARDED_SCHEME' in environ:
 
            proto = environ.get('HTTP_X_FORWARDED_SCHEME')
 
        elif 'HTTP_X_FORWARDED_PROTO' in environ:
 
            proto = environ.get('HTTP_X_FORWARDED_PROTO')
 
        else:
 
            proto = 'http'
 
        org_proto = proto
 

	
 
        # if we have force, just override
 
        if str2bool(self.config.get('force_https')):
 
            proto = 'https'
 

	
 
        environ['wsgi.url_scheme'] = proto
 
        environ['wsgi._org_proto'] = org_proto
0 comments (0 inline, 0 general)