git.iko.soy/searx
on master help sign in
Fix security vulnerabilities in suggested nginx configuration
6b59800Alex Balgavy
docs/admin/filtron.rst+1−1
compare with master
unifiedsplit
@@ -173,7 +173,7 @@ Use it along with ``nginx`` with the following example configuration.
173 location /searx {
173 location /searx {
174 proxy_pass http://127.0.0.1:4004/;
174 proxy_pass http://127.0.0.1:4004/;
175
175
176− proxy_set_header Host $http_host;
176+ proxy_set_header Host $host;
177 proxy_set_header Connection $http_connection;
177 proxy_set_header Connection $http_connection;
178 proxy_set_header X-Real-IP $remote_addr;
178 proxy_set_header X-Real-IP $remote_addr;
179 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
179 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
docs/admin/installation-nginx.rst+8−8
@@ -182,7 +182,7 @@ Started wiki`_ is always a good resource *to keep in the pocket*.
182 location /searx {
182 location /searx {
183 proxy_pass http://127.0.0.1:4004/;
183 proxy_pass http://127.0.0.1:4004/;
184
184
185− proxy_set_header Host $http_host;
185+ proxy_set_header Host $host;
186 proxy_set_header Connection $http_connection;
186 proxy_set_header Connection $http_connection;
187 proxy_set_header X-Real-IP $remote_addr;
187 proxy_set_header X-Real-IP $remote_addr;
188 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
188 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -190,8 +190,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.
190 proxy_set_header X-Script-Name /searx;
190 proxy_set_header X-Script-Name /searx;
191 }
191 }
192
192
193− location /searx/static {
193+ location /searx/static/ {
194− alias /usr/local/searx/searx-src/searx/static;
194+ alias /usr/local/searx/searx-src/searx/static/;
195 }
195 }
196
196
197
197
@@ -205,7 +205,7 @@ Started wiki`_ is always a good resource *to keep in the pocket*.
205 location /morty {
205 location /morty {
206 proxy_pass http://127.0.0.1:3000/;
206 proxy_pass http://127.0.0.1:3000/;
207
207
208− proxy_set_header Host $http_host;
208+ proxy_set_header Host $host;
209 proxy_set_header Connection $http_connection;
209 proxy_set_header Connection $http_connection;
210 proxy_set_header X-Real-IP $remote_addr;
210 proxy_set_header X-Real-IP $remote_addr;
211 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
211 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -309,8 +309,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.
309 proxy_buffering off;
309 proxy_buffering off;
310 }
310 }
311
311
312− location /searx/static {
312+ location /searx/static/ {
313− alias /usr/local/searx/searx-src/searx/static;
313+ alias /usr/local/searx/searx-src/searx/static/;
314 }
314 }
315
315
316 The ``X-Script-Name /searx`` is needed by the searx implementation to
316 The ``X-Script-Name /searx`` is needed by the searx implementation to
@@ -328,8 +328,8 @@ Started wiki`_ is always a good resource *to keep in the pocket*.
328 uwsgi_pass unix:/run/uwsgi/app/searx/socket;
328 uwsgi_pass unix:/run/uwsgi/app/searx/socket;
329 }
329 }
330
330
331− location /searx/static {
331+ location /searx/static/ {
332− alias /usr/local/searx/searx-src/searx;
332+ alias /usr/local/searx/searx-src/searx/;
333 }
333 }
334
334
335 For searx to work correctly the ``base_url`` must be set in the
335 For searx to work correctly the ``base_url`` must be set in the
utils/templates/etc/nginx/default.apps-available/searx.conf:filtron+3−3
@@ -3,7 +3,7 @@
3location ${SEARX_URL_PATH} {
3location ${SEARX_URL_PATH} {
4 proxy_pass http://127.0.0.1:4004/;
4 proxy_pass http://127.0.0.1:4004/;
5
5
6− proxy_set_header Host \$http_host;
6+ proxy_set_header Host \$host;
7 proxy_set_header Connection \$http_connection;
7 proxy_set_header Connection \$http_connection;
8 proxy_set_header X-Real-IP \$remote_addr;
8 proxy_set_header X-Real-IP \$remote_addr;
9 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
9 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
@@ -11,6 +11,6 @@ location ${SEARX_URL_PATH} {
11 proxy_set_header X-Script-Name ${SEARX_URL_PATH};
11 proxy_set_header X-Script-Name ${SEARX_URL_PATH};
12}
12}
13
13
14−location ${SEARX_URL_PATH}/static {
14+location ${SEARX_URL_PATH}/static/ {
15− alias ${SEARX_SRC}/searx/static;
15+ alias ${SEARX_SRC}/searx/static/;
16}
16}