Просмотр исходного кода

HUE-9050 [core] Add 80 to trusted port for CSRF token

Change-Id: Ic6f746924cc518faf2d7f7107f1677e832e5bb74
Jean-Francois Desjeans Gauthier 6 лет назад
Родитель
Сommit
c2695f94c1

+ 2 - 0
desktop/conf.dist/hue.ini

@@ -691,6 +691,8 @@
     ## knox_proxyhosts=server1.domain.com,server2.domain.com
     # List of Kerberos principal name which is allowed to impersonate others
     ## knox_principal=knox1,knox2
+    # Comma separated list of strings representing the ports that the Hue server can trust as knox port.
+    ## knox_ports=80,8443
 
   # Configuration options for Kerberos integration for secured Hadoop clusters
   # ------------------------------------------------------------------------

+ 2 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -692,6 +692,8 @@
     ## knox_proxyhosts="server1.domain.com,server2.domain.com"
     # List of Kerberos principal name which is allowed to impersonate others
     ## knox_principal=knox1,knox2
+    # Comma separated list of strings representing the ports that the Hue server can trust as knox port.
+    ## knox_ports=80,8443
 
 
   # Configuration options for Kerberos integration for secured Hadoop clusters

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -833,6 +833,12 @@ KNOX = ConfigSection(
       type=coerce_csv,
       help=_('Comma separated list of strings representing the host names that the Hue server can trust as knox hosts.')
     ),
+    KNOX_PORTS = Config(
+      key='knox_ports',
+      default=['80', '8443'],
+      type=coerce_csv,
+      help=_('Comma separated list of strings representing the ports that the Hue server can trust as knox port.')
+    ),
   )
 )
 

+ 12 - 2
desktop/core/src/desktop/settings.py

@@ -424,8 +424,18 @@ if desktop.conf.SESSION.TRUSTED_ORIGINS.get():
 
 # This is required for knox
 if desktop.conf.KNOX.KNOX_PROXYHOSTS.get(): # The hosts provided here don't have port. Add default knox port
-  TRUSTED_ORIGINS += desktop.conf.KNOX.KNOX_PROXYHOSTS.get()
-  TRUSTED_ORIGINS = [host.split(':')[0] + ':' + (host.split(':')[1] if len(host.split(':')) > 1 else '8443') for host in TRUSTED_ORIGINS]
+  if desktop.conf.KNOX.KNOX_PORTS.get():
+    hostport = []
+    ports = [host.split(':')[1] for host in desktop.conf.KNOX.KNOX_PROXYHOSTS.get() if len(host.split(':')) > 1] # In case the ports are in hostname
+    for port in ports + desktop.conf.KNOX.KNOX_PORTS.get():
+      if port == '80':
+        port = '' # Default port needs to be empty
+      else:
+        port = ':' + port
+      hostport += [host.split(':')[0] + port for host in desktop.conf.KNOX.KNOX_PROXYHOSTS.get()]
+    TRUSTED_ORIGINS += hostport
+  else:
+    TRUSTED_ORIGINS += desktop.conf.KNOX.KNOX_PROXYHOSTS.get()
 
 if TRUSTED_ORIGINS:
   CSRF_TRUSTED_ORIGINS = TRUSTED_ORIGINS