Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to rename api.php #2132

Merged
merged 6 commits into from
Jul 15, 2022
Merged

Allow to rename api.php #2132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ccda251
Allow to rename api.php
luigifab May 18, 2022
0835774
Add some docs for security
luigifab Jun 26, 2022
7cb9cc5
Add missing space
luigifab Jun 26, 2022
a52eab4
Typo
luigifab Jul 12, 2022
acaeb7a
Update Text
luigifab Jul 14, 2022
faa6ecc
Update README.md
addison74 Jul 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,29 @@ git add -A && git commit

[More Information](http://openmage.github.io/magento-lts/install.html)

## Secure your installation

Don't use common paths like /admin for OpenMage Backend URL. Don't use the path in _robots.txt_ and keep it secret. You can change it from Backend (System / Configuration / Admin / Admin Base Url) or by editing _app/etc/local.xml_:

```xml
<config>
<admin>
<routers>
<adminhtml>
<args>
<frontName><![CDATA[admin]]></frontName>
</args>
</adminhtml>
</routers>
</admin>
</config>
```

Don't use common file names like api.php for OpenMage API URLs to prevent attacks. Don't use the new file name in _robots.txt_ and keep it secret with your partners. After renaming the file you must update the webserver configuration as follows:

* Apache .htaccess: `RewriteRule ^api/rest api.php?type=rest [QSA,L]`
* Nginx: `rewrite ^/api/(\w+).*$ /api.php?type=$1 last;`

## Changes

Most important changes will be listed here, all other changes since `19.4.0` can be found in
Expand Down
2 changes: 1 addition & 1 deletion app/code/core/Mage/Api/Helper/Data.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,7 @@ public function getServiceUrl($routePath = null, $routeParams = null, $htmlSpeci
$uri = Zend_Uri_Http::fromString($url);
$uri->setHost($request->getHttpHost());
if (!$urlModel->getRouteFrontName()) {
$uri->setPath('/' . trim($request->getBasePath() . '/api.php', '/'));
$uri->setPath('/' . trim($request->getBasePath() . '/' . basename(getenv('SCRIPT_FILENAME')), '/'));
} else {
$uri->setPath($request->getBaseUrl() . $request->getPathInfo());
}
Expand Down
3 changes: 2 additions & 1 deletion app/code/core/Mage/Api2/Model/Route/ApiType.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ class Mage_Api2_Model_Route_ApiType extends Mage_Api2_Model_Route_Abstract imple
{
/**
* API url template with API type variable
* @deprecated
*/
const API_ROUTE = 'api/:api_type';

Expand All @@ -56,6 +57,6 @@ public function __construct(
Zend_Translate $translator = null,
$locale = null
) {
parent::__construct(array(Mage_Api2_Model_Route_Abstract::PARAM_ROUTE => self::API_ROUTE));
parent::__construct(array(Mage_Api2_Model_Route_Abstract::PARAM_ROUTE => str_replace('.php', '', basename(getenv('SCRIPT_FILENAME'))) . '/:api_type'));
}
}