Re: configuring lighttpd proxy for standalone roundup server

John,
  I changed the config.ini to say https://example.com/trackers/example

I also changed my lighttpd proxy to the following:

       $HTTP["host"] =~ "(^|\.)example\.com$" {

                proxy.header = (
                        "map-urlpath" => ( "/tracker/example/" => "/" )
                )

                proxy.server = (
                        "/tracker" => (("host" => "127.0.0.1", "port" => 10220))
                )

        }

I can now properly activate the password reset.....However now I get a
very strange path translation:

This is the path I get in the email:

 https://example.com/tracker/example/user?@template=forgotten&@action=passrst&otk=McEezI3tJjZ7dsG5RpIO6Xe0fHg2OJP1

However, when I try to access that link, I get a 404:

Error response

Error code: 404

Message: /user/?@template=forgotten&@action=passrst&otk=McEezI3tJjZ7dsG5RpIO6Xe0fHg2OJP1.

Error code explanation: 404 - Nothing matches the given URI.

These are the log entries:

127.0.0.1 - - [16/Apr/2023 15:14:58] "GET
/user?@template=forgotten&@action=passrst&otk=McEezI3tJjZ7dsG5RpIO6Xe0fHg2OJP1
HTTP/1.1" 301 -
127.0.0.1 - - [16/Apr/2023 15:14:58] code 404, message
/user/?@template=forgotten&@action=passrst&otk=McEezI3tJjZ7dsG5RpIO6Xe0fHg2OJP1
127.0.0.1 - - [16/Apr/2023 15:14:58] "GET
/user/?@template=forgotten&@action=passrst&otk=McEezI3tJjZ7dsG5RpIO6Xe0fHg2OJP1
HTTP/1.1" 404 -


On Sun, Apr 16, 2023 at 9:49 AM John P. Rouillard <[email protected]> wrote:
>
> Hi Dave:
>
> In message <CAETHaKrN_oXvTNA2iGiCprwRK4wwiKPJaYiTkXbJYvsZV4TMoQ@mail.gmail.com>
> ,
> Dave Bender writes:
> >Sorry forgot to add:
> >
> >127.0.0.1 - - [15/Apr/2023 22:28:00] "GET
> >/name/@@file/glyphicons-halflings.png HTTP/1.1" 200 -
> >127.0.0.1 - - [15/Apr/2023 22:28:03] "GET
> >/name/user?@template=forgotten HTTP/1.1" 200 -
> >2023-04-15 22:28:08,610 ERROR csrf Referer header check failed for
> >user2. Value=https://example.com/tracker/name/user?@template=forgotten
>
> Thanks for including this.
>
> That's what I expect. The referer is using https, but your web setting
> is using http so they don't match.
>
> I don't know why you are seeing two URL's in the web interface. You
> should only see one just like you do in the log. I just ran the
> Referer test case under the debugger to verify that Roundup is just
> repeating the Referer header value.
>
> Also the log message disproves my thought that lighttpd was
> redirecting from http to https. Then it was representing this in the
> Referer header with the dual URL's, separated by a newline.
>
> --
>                                 -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.
>
>


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users