<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I quickly re-applied the update and it looks like it took this time.</div><div><br></div><div><span class="Apple-style-span" style="font-family: Times; "><pre>/home/httpd/lib/perl/Apache/lonsupportreq.pm:# $Id: lonsupportreq.pm,v 1.67.2.1 2013/01/04 19:07:17 raeburn Exp $
</pre><div><br></div><div>Now it's time to get the PCI scan re-done.</div><div><br></div></span></div><div>Thanks!</div><div><br></div><div><br></div><br><div><div>On Jan 13, 2013, at 8:01 PM, Stuart Raeburn wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi,<br><br><blockquote type="cite">I managed to get many to the PCI failure items correct, but am still getting dinged by the PCI scanning company for cross-site scripting (despite updating my lonsupportreq.pm as suggested by Stuart).<br></blockquote><br>Are you sure /home/httpd/lib/perl/Apache/lonsupportreq.pm has actually been updated?<br><br>The ID line reporetd from the installed module (/home/httpd/lib/perl/Apache/lonsupportreq.pm) on your <a href="http://physics.jp2hs.org">physics.jp2hs.org</a> server is still:<br><br>$Id: lonsupportreq.pm,v 1.66 2011/03/03 17:29:29<br><br>whereas I would expect it to be:<br><br>$Id: lonsupportreq.pm,v 1.67.2.1 2013/01/04 19:07:17<br><br>if lonsupportreq.pm had been updated.<br><br>If you have ssh access to <a href="http://physics.jp2hs.org">physics.jp2hs.org</a> could you log-in and let me know the output from the following command:<br><br>ls -al /home/httpd/lib/perl/Apache/lonsupportreq.pm<br><br><blockquote type="cite">Gerd suggested that I can disable helpdesk in domain configuration, but I have not been able to figure out how to do that. Any pointers?<br></blockquote><br>The DC's domain configuration settings GUI interface for LON-CAPA production releases (i.e., 2.10 and older) do *not* support disabling of the "Contact Helpdesk" link, although this feature has been implemented for the upcoming LON-CAPA 2.11.<br><br>Anyway to suppress display of that link on 2.10 and older you need to use a text editor to change the following line in<br><br>/etc/httpd/conf/loncapa.conf<br><br>from<br><br>PerlSetVar lonSupportEMail <a href="mailto:jon.hall@jp2hs.org">jon.hall@jp2hs.org</a><br><br>to<br><br>PerlSetVar lonSupportEMail<br><br><br>Then do:<br><br>/etc/init.d/httpd reload<br><br>That said, one of the features of LON-CAPA is the ability for a user from any domain in the LON-CAPA network to log-in to any server (including servers from other domains).<br><br>Consequently it is actually desirable that the Contact Helpdesk link is available, such that if for example, a student from the jp2hs domain happens to attempt to log-in to one of the MSU servers (which might occur when your server was busy, for example) and he/she encounters a problem, and log-in fails, any help message composed by the student via the Contact Helpdesk will be routed to the helpdesk for the student's domain (i.e., to you), rather than to e-mail address for the server administrator of the machine.<br><br>Also, I see you have followed my suggestion and installed free SSL certs from <a href="http://startssl.com">startssl.com</a>. Accordingly, I have updated the entry for jp2l1 to specify https (instead of http) in the authoritative cluster tables advertised by the LON-CAPA Academic Consortium "DNS" servers.<br><br>You should make the same change in /home/httpd/lonTabs/hosts.tab<br>i.e., replace:<br><br>jp2l1:jp2:library:physics.jp2hs.org:http:jp2hs.org<br><br>with<br><br>jp2l1:jp2:library:physics.jp2hs.org:https:jp2hs.org<br><br>Lastly, I would encourage you to enable rewrites from http to https by doing the following:<br><br>cd /etc/httpd/conf/<br>cp rewrites/loncapa_rewrite_on.conf loncapa_rewrite.conf<br><br>/etc/init.d/httpd reload<br><br>Currently:<br><a href="http://physics.jp2hs.org/">http://physics.jp2hs.org/</a><br><br>reports a 400 error "Bad Request".<br><br>See section 2.18 "Encrypting server traffic with SSL" on p. 18 of the domain coordination manual for more information:<br><br>https://physics.jp2hs.org/adm/help/domain.manual.pdf<br><br><br>Stuart Raeburn<br>LON-CAPA Academic Consortium<br><br><br>Quoting Jon Hall <jdh65@bellsouth.net>:<br><br><blockquote type="cite">I managed to get many to the PCI failure items correct, but am still getting dinged by the PCI scanning company for cross-site scripting (despite updating my lonsupportreq.pm as suggested by Stuart).<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Gerd suggested that I can disable helpdesk in domain configuration, but I have not been able to figure out how to do that. Any pointers?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks for all assistance,<br></blockquote><blockquote type="cite">Jon Hall<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On Jan 3, 2013, at 7:55 PM, Gerd Kortemeyer wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Can be solved by switched to HTTPS, but to avoid warnings, you need a purchased certificate. Nothing we can do about it.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">web program allows cross-site scripting in query string (/adm/login)<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">web program allows cross-site scripting in query string (/adm/helpdesk)<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Disable helpdesk in domain configuration.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">web server allows cross-site tracing<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">See above.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">cross-site scripting vulnerability in orgurl parameter to /adm/helpdesk<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">See above.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">- Gerd.<br></blockquote></blockquote><br>_______________________________________________<br>LON-CAPA-admin mailing list<br>LON-CAPA-admin@mail.lon-capa.org<br>http://mail.lon-capa.org/mailman/listinfo/lon-capa-admin<br></div></blockquote></div><br></body></html>