QUAL set AcceptPathInfo Off in Apache conf as recommended

[JonBendtsen]

QUAL set AcceptPathInfo Off in Apache conf as recommended
Applying this PR would change the Dockerfile such that the image is built with Apache configuration that set AcceptPathInfo Off which is recommended by Dolibarr itself

https://wiki.dolibarr.org/index.php/Security_information

I tested this with hand changes in Dolibarrs official docker image for develop

[creekorful]

Hello,

Won't this break the API routing? Have you tested with the API as well?

[JonBendtsen]

Hello,

Won't this break the API routing? Have you tested with the API as well?

I would say no, but I have not tried the API explorer, only with hurl tests

jonbendtsen@Jons-MacBook-Pro hurl % clear ; ./run.sh --port=50080 --user=jbendtsen --pass=**************** --exclude=contracts --apikey=**************************** --exclude=warehouses --exclude=commande --exclude=propal


----- Run hurl test on APIs ---
INFO: 1. Running tests (API,GUI,public) that do not require authentication
Success api/00_explorer.hurl (1 request(s) in 28 ms)
Success api/00_foobar.hurl (1 request(s) in 29 ms)
Success api/status/00_status.hurl (1 request(s) in 31 ms)
Success public/payment/00_payment_newpayment.hurl (1 request(s) in 31 ms)
Success gui/00_HOME.hurl (1 request(s) in 32 ms)
Success public/onlinesign/00_onlinesign_newonlinesign.hurl (1 request(s) in 38 ms)
Success api/login/00_login_POST.hurl (1 request(s) in 1040 ms)
Success api/login/00_login_GET.hurl (1 request(s) in 1041 ms)
--------------------------------------------------------------------------------
Executed files:    8
Executed requests: 8 (7.7/s)
Succeeded files:   8 (100.0%)
Failed files:      0 (0.0%)
Duration:          1044 ms (0h:0m:1s:44ms)

INFO: Using existing DOLAPIKEY.
INFO: 2.a. Running API tests that do require authentication
Success api/status/10_status.hurl (1 request(s) in 23 ms)
Success api/setup/10_setup_company.hurl (1 request(s) in 40 ms)
Success api/setup/10_setup_conf.hurl (1 request(s) in 49 ms)
Success api/users/10_groups.hurl (15 request(s) in 331 ms)
Success api/eventattendees/10_eventattendees.hurl (19 request(s) in 297 ms)
Success api/users/10_users.hurl (17 request(s) in 382 ms)
Success api/emailtemplates/10_emailtemplates.hurl (23 request(s) in 414 ms)
Success api/setup/10_setup_dictionary_countries.hurl (18 request(s) in 442 ms)
Success api/mailings/10_mailings.hurl (34 request(s) in 555 ms)
Success api/setup/10_setup_modules.hurl (13 request(s) in 600 ms)
Success api/setup/10_setup_dictionary_countries_load_region_state.hurl (28 request(s) in 878 ms)
Success api/compta/facture/10_facture.hurl (20 request(s) in 1733 ms)
--------------------------------------------------------------------------------
Executed files:    12
Executed requests: 190 (109.1/s)
Succeeded files:   12 (100.0%)
Failed files:      0 (0.0%)
Duration:          1741 ms (0h:0m:1s:741ms)

Success gui/save_login_cookie.hurl (2 request(s) in 129 ms)
--------------------------------------------------------------------------------
Executed files:    1
Executed requests: 2 (15.4/s)
Succeeded files:   1 (100.0%)
Failed files:      0 (0.0%)
Duration:          130 ms (0h:0m:0s:130ms)

INFO: 2.b. Running GUI tests that do require authentication
Success gui/10_HOME.hurl (1 request(s) in 58 ms)
Success gui/eventorganization/10_conferenceorbooth_list.hurl (1 request(s) in 100 ms)
Success gui/admin/10_mails_templates.hurl (1 request(s) in 123 ms)
Success gui/comm/mailing/10_mailing.hurl (1 request(s) in 135 ms)
Success gui/eventorganization/10_eventorganization.hurl (4 request(s) in 337 ms)
Success gui/projet/10_projet_element.hurl (15 request(s) in 589 ms)
--------------------------------------------------------------------------------
Executed files:    6
Executed requests: 23 (38.9/s)
Succeeded files:   6 (100.0%)
Failed files:      0 (0.0%)
Duration:          591 ms (0h:0m:0s:591ms)

yeah, it does seem to break the API explorer, so maybe we either need to give up, make an exception for the acceptpath

Either way, I think this page should be updated

https://wiki.dolibarr.org/index.php/Security_information

[JonBendtsen]

nope, even inside a Location it will not work once acceptpath is off. I'll update the wiki with a warning that it will influence the API explorer - but seemingly not the API calls itself.

Here's an idea.

One could run the API in a different container which did allow acceptpath, but the main dolibarr container did not. But that's for specialists