Bug 25647
| Summary: | Zwangsumleitung auf SSL-gesicherte Seite ermöglichen | ||
|---|---|---|---|
| Product: | UCS | Reporter: | Jan Christoph Ebersbach <ebersbach> |
| Component: | Apache | Assignee: | Bugzilla Mailingliste <bugzilla> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | minor | ||
| Priority: | P5 | CC: | best, birkefeld, da, gohmann, grandjean, hahn, meybohm, petersen |
| Version: | UCS 3.0 | ||
| Target Milestone: | UCS 3.x | ||
| Hardware: | Other | ||
| OS: | Linux | ||
| See Also: | http://forge.univention.org/bugzilla/show_bug.cgi?id=38016 | ||
| What kind of report is it?: | Security Issue | What type of bug is this?: | --- |
| Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
| User Pain: | Enterprise Customer affected?: | ||
| School Customer affected?: | ISV affected?: | ||
| Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
| Ticket number: | Bug group (optional): | External feedback, Security | |
| Max CVSS v3 score: | |||
*** Bug 14844 has been marked as a duplicate of this bug. *** *** Bug 36103 has been marked as a duplicate of this bug. *** Given that more and more deployments may be seen outside internal networks, this enhancement might help to increase security. In a second step it should be checked if it is possible to enable it by default. Requested again via 2014102321000202 *** This bug has been marked as a duplicate of bug 38016 *** yes, duplicate. (In reply to Dirk Ahrnke from comment #3) > Given that more and more deployments may be seen outside internal networks, > this enhancement might help to increase security. > In a second step it should be checked if it is possible to enable it by > default. Well, it has some disadvantages described in Bug #38016 comment 1. |
UCS sollte die Zwangsumleitung von Anfragen auf die SSL-gesicherte Seite per UCR-Variable ermöglichen. Folgende Einstellungen sind dafür in die Datei /etc/apache2/sites-available/default einzufügen: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}