Index: openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl,v diff -u -r1.1.2.34 -r1.1.2.35 --- openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl 13 Jan 2022 10:05:02 -0000 1.1.2.34 +++ openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl 17 Jan 2022 09:31:26 -0000 1.1.2.35 @@ -107,6 +107,7 @@ ::acs::register_icanuse "ns_parseurl -strict" [acs::cmd_error_contains ns_parseurl -strict] ::acs::register_icanuse "ns_server unmap" [acs::cmd_has_subcommand ns_server unmap] ::acs::register_icanuse "ns_set keys" [acs::cmd_has_subcommand ns_set keys] +::acs::register_icanuse "ns_set values" [acs::cmd_has_subcommand ns_set values] ::acs::register_icanuse "ns_setcookie -samesite" [acs::cmd_error_contains ns_setcookie -samesite] ::acs::register_icanuse "ns_urlencode -part oauth1" [acs::cmd_error_contains {ns_urlencode -part xxx} oauth1] ::acs::register_icanuse "ns_writer" {[info commands ::ns_writer] ne ""} Index: openacs-4/packages/acs-tcl/tcl/security-procs.tcl =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/security-procs.tcl,v diff -u -r1.126.2.57 -r1.126.2.58 --- openacs-4/packages/acs-tcl/tcl/security-procs.tcl 4 Oct 2021 09:35:27 -0000 1.126.2.57 +++ openacs-4/packages/acs-tcl/tcl/security-procs.tcl 17 Jan 2022 09:31:26 -0000 1.126.2.58 @@ -2475,96 +2475,69 @@ } } -ad_proc -public security::locations {} { +ad_proc -private security::configured_locations { + {-suppress_http_port:boolean false} + {-secure_conn:boolean false} +} { - This function returns the configured locations and the current - location and the vhost locations, potentially in HTTP or in HTTPs - variants. + This function returns the configured locations. When the package parameter "SuppressHttpPort" of acs-tcl parameter is true, then an alternate location without a port is included. This proc also assumes hostnames from host_node_map table are accurate and legit. - The term location refers to protocol://domain:port for - website. + The term location refers to "protocol://domain:port" for website. - @return insecure location and secure location followed possibly by alternate location(s) as a list. + @return list of locations } { set locations [list] set portless_locations {} # - # Get Information from configured servers + # Get configuration information from the configured servers. # set driver_info [security::configured_driver_info] foreach d $driver_info { # - # port == 0 means that the driver is just used for sending, but not for receiving + # port == 0 means that the driver is just used for sending, + # but not for receiving. # if {[dict get $d port] != 0} { set location [dict get $d location] if {$location ni $locations} {lappend locations $location} - set location [dict get $d proto]://[dict get $d host] - if {$location ni $portless_locations && - $location ni $locations} { - lappend portless_locations $location + set hosts [dict get $d host] + if {[acs::icanuse "ns_set values"]} { + set virtualservers \ + [ns_configsection ns/module/[dict get $d driver]/servers] + if {$virtualservers ne ""} { + lappend hosts {*}[ns_set values $virtualservers] + } } - append location :[dict get $d port] - if {$location ni $locations} {lappend locations $location} - } - } - - if {[ns_conn isconnected]} { - # - # Is the current connection secure? - # - set secure_conn_p [expr {[security::secure_conn_p] || [ad_conn behind_secure_proxy_p]}] - - set current_location [util_current_location] - if {$current_location ni $locations} { - lappend locations $current_location - } - - # - # When we are on a secure connection, the command above added - # already a secure connection. When we are on a nonsecure - # connection, but HTTPS is available, allow as well the - # current host via the secure connection. - # - if {!$secure_conn_p && [https_available_p]} { - set secure_current_location [security::get_secure_location] - #ns_log notice "ADD secure_current_location: <$secure_current_location>" - if {$secure_current_location ni $locations} { - lappend locations $secure_current_location + foreach host $hosts { + set location [dict get $d proto]://$host + if {$location ni $portless_locations + && $location ni $locations + } { + lappend portless_locations $location + } + append location :[dict get $d port] + if {$location ni $locations} { + lappend locations $location + } } } - } else { - set secure_conn_p 0 } # - # Consider if we are behind a proxy and don't want to publish the - # proxy's backend port. In this cases, SuppressHttpPort can be used - # - set suppress_http_port [parameter::get -parameter SuppressHttpPort \ - -boolean \ - -package_id [apm_package_id_from_key acs-tcl] \ - -default 0] - if {$suppress_http_port} { - lappend locations {*}$portless_locations - } - - - # # Add locations from host_node_map # - set host_node_map_hosts_list [acs::misc_cache eval security-locations-host-names { - db_list get_node_host_names {select host from host_node_map} - }] + set host_node_map_hosts_list \ + [db_list get_node_host_names {select host from host_node_map}] + if { [llength $host_node_map_hosts_list] > 0 } { - if { $suppress_http_port } { + if { $suppress_http_port_p } { foreach hostname $host_node_map_hosts_list { lappend locations "http://${hostname}" if {$secure_conn_p} { @@ -2588,6 +2561,83 @@ } } } + + if {$suppress_http_port_p} { + lappend locations {*}$portless_locations + } + + return $locations +} + +ad_proc -public security::locations {} { + + This function returns the configured locations and the current + location and the vhost locations, potentially in HTTP or in HTTPs + variants. + + When the package parameter "SuppressHttpPort" of acs-tcl parameter + is true, then an alternate location without a port is included. + This proc also assumes hostnames from host_node_map table are + accurate and legit. + + The term location refers to protocol://domain:port for + website. + + @return insecure location and secure location followed possibly by alternate location(s) as a list. + +} { + # + # Is the current connection secure? + # + set secure_conn_p [expr {[ns_conn isconnected] + ? ([security::secure_conn_p] || [ad_conn behind_secure_proxy_p]) + : 0}] + # + # Consider if we are behind a proxy and don't want to publish the + # proxy's backend port. In this cases, SuppressHttpPort can be used + # + set suppress_http_port_p [parameter::get -parameter SuppressHttpPort \ + -boolean \ + -package_id [apm_package_id_from_key acs-tcl] \ + -default 0] + # + # Get Information from configured servers + # + set locations [acs::misc_cache eval security-configure-locations-$suppress_http_port_p-$secure_conn_p { + security::configured_locations -suppress_http_port=$suppress_http_port_p -secure_conn=$secure_conn_p + }] + + # + # When we are connected, add the current location if is not there + # already, also potentially in a secure fashion. + # + # This is probably not needed, but is kept here for backwards + # compatibility. For the time being, add log statements when this + # happens. + # + if {[ns_conn isconnected]} { + + set current_location [util_current_location] + if {$current_location ni $locations} { + ns_log notice "security::locations add connected location <$current_location>" + lappend locations $current_location + } + + # + # When we are on a secure connection, the command above added + # already a secure connection. When we are on a nonsecure + # connection, but HTTPS is available, allow as well the + # current host via the secure connection. + # + if {!$secure_conn_p && [https_available_p]} { + set secure_current_location [security::get_secure_location] + if {$secure_current_location ni $locations} { + ns_log notice "security::locations add connected secure location <$secure_current_location>" + lappend locations $secure_current_location + } + } + } + #ns_log notice "security::locations <$locations>" return $locations }