Comments (7)
@EricTendian Any feedback?
from beanstalk_console.
@archon810 did you mean to tag me or someone else in your comment?
from beanstalk_console.
Oh I saw you pushed a PR for my previous ticket and figured you were a core committer. If not, I apologize.
Maybe @pentium10 is the right person then.
from beanstalk_console.
Assuming that your Apache is configured properly, there's nothing stopping you from disabling the HTTP basic auth set up by beanstalk_console and using .htaccess instead. (I'm considering doing so for a different reason - so that the people on my team can have their own passwords rather than a shared password, and so it can be stored in the hashed versions used by htpasswd rather than plaintext in config.php.)
The specific security issue you brought up (being able to access sensitive non-PHP files like storage.json) is not an issue if you set this up properly. beanstalk_console itself should not be within your public web directory; you should be symlinking from the web directory to beanstalk_console/public
. The only thing visible by an attacker is the actual contents of the public directory. This is standard for PHP applications, but probably should be better documented in the readme.
from beanstalk_console.
Yeah, I ended up disabling the PHP file security and adding a .htaccess. You're probably right about /public, but I wasn't sure it was even going to work like that if I stick beanstalk_console into project root/tools/beanstalk_console
, then symlink project root/public/beanstalk_console
to project root/tools/beanstalk_console/public
since the files in project root/public/beanstalk_console
would potentially not have access to the right files in ..
(..
would become project root/public/
).
from beanstalk_console.
Assuming your Apache DocumentRoot is project root/public
, that approach should work. When it accesses ../lib
or whatever, it is relative to the "real" path not the symlinked path.
from beanstalk_console.
I am closing this as the package should not address all AuthType support for apache/nginx or others. Also there are no critical non PHP files in the /public
folder, so people cannot directly access by link sensitive content.
from beanstalk_console.
Related Issues (20)
- Moving a buried job back to a tube being watched by multiple workers causes same job to be reserved multiple times? HOT 4
- Top nav server list should show "named" servers with their names HOT 1
- Can't pull server names out of enviroment variable HOT 1
- Console needs a favicon
- HTML page title should vary depending on which page you're viewing
- 502 Bad Gateway error HOT 2
- PHP 7.2 Deprecated: __autoload() is deprecated, use spl_autoload_register() instead
- composer/installers support HOT 6
- Setting to enable auto-refresh by default HOT 9
- What's the logic about search? HOT 7
- Automated Docker Builds HOT 9
- It doesn't show the protobuf content
- Creating sample with same name from within tube view fails without feedback
- issue in php8.0 when pressing on the refresh button HOT 4
- Please make the storage file writable: /home/admin/www/html/beanstalk/storage.json HOT 2
- Who to contact for security issues HOT 7
- Undef issue if showing all servers
- Remove the composer/installers dependency HOT 3
- Unable to find image 'beanstalk_console:latest'
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from beanstalk_console.