diff options
| author | Dan Fandrich <danf@mageia.org> | 2025-05-23 18:50:29 -0700 |
|---|---|---|
| committer | Dan Fandrich <danf@mageia.org> | 2025-05-23 18:58:07 -0700 |
| commit | e7818b9d1f8957ed4ae02f22b1e11e681bf45549 (patch) | |
| tree | fd308ff09fbdd1ad3edb0705a1f3853943ddf8a8 /modules/apache | |
| parent | de3c56d3dff7c23adf9e6f1b6ebd141dcfb4efdc (diff) | |
| download | puppet-e7818b9d1f8957ed4ae02f22b1e11e681bf45549.tar puppet-e7818b9d1f8957ed4ae02f22b1e11e681bf45549.tar.gz puppet-e7818b9d1f8957ed4ae02f22b1e11e681bf45549.tar.bz2 puppet-e7818b9d1f8957ed4ae02f22b1e11e681bf45549.tar.xz puppet-e7818b9d1f8957ed4ae02f22b1e11e681bf45549.zip | |
Block expensive svnweb operations without a cookie
If an expensive request comes in from anyone without a cookie attached,
redirect to a page where the cookie is set using JavaScript, then
redirect back. This should block robots from these paths, most of which
do not support JavaScript. The collateral damage is that a JavaScript
browser is now required for users to access those paths. The contents
of the cookie is not currently checked, merely that it is set.
Diffstat (limited to 'modules/apache')
| -rw-r--r-- | modules/apache/templates/vhost_fcgid.conf | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/modules/apache/templates/vhost_fcgid.conf b/modules/apache/templates/vhost_fcgid.conf index 75ac9300..3aed1ea2 100644 --- a/modules/apache/templates/vhost_fcgid.conf +++ b/modules/apache/templates/vhost_fcgid.conf @@ -23,6 +23,15 @@ RewriteCond %{QUERY_STRING} pathrev=|r1= RewriteCond %{HTTP_USER_AGENT} "Googlebot|GoogleOther|bingbot|Yahoo! Slurp|ClaudeBot|Amazonbot|YandexBot|SemrushBot|Barkrowler|DataForSeoBot|PetalBot|facebookexternalhit|GPTBot|ImagesiftBot|spider|Spider|iPod|Trident|Presto" RewriteRule . - [R=403,L] +# Only let expensive operations through when a cookie is set. If no cookie is +# set, redirect to a page where it will be set using JavaScript and redirect +# back. This will block requests from user agents that do not support +# JavaScript, which includes many robots. +RewriteCond %{QUERY_STRING} pathrev=|r1= +RewriteCond %{REQUEST_URI} !/_check +RewriteCond %{HTTP_COOKIE} !session=([^;]+) [novary] +RewriteRule . %{REQUEST_SCHEME}://%{SERVER_NAME}:%{SERVER_PORT}/_check?to=%{REQUEST_URI}?%{QUERY_STRING} [R=302,L] + # Block abusive spiders by IP address who don't identify themselves in the # User-Agent: string RewriteCond expr "-R '47.76.0.0/14' || -R '47.80.0.0/14' || -R '47.208.0.0/16' || -R '47.238.0.0/16' || -R '8.210.0.0/16' || -R '8.218.0.0/16' || -R '188.239.0.0/18' || -R '166.108.192.0/18' || -R '124.243.160.0/19' || -R '101.46.0.0/20'" |