[mod] disable /stats page by default to prevent potential data leak
commit9b5415ea2f68b05a9c17d335ef31001df3998355
authorAdam Tauber <asciimoo@gmail.com>
dateThu 13 May 2021, 22:20 (5 years ago)
parent6cd3bf3
searx/settings.yml+1
@@ -2,6 +2,7 @@ general:
22 debug : False # Debug mode, only for development
33 instance_name : "searx" # displayed name
44 contact_url: False # mailto:contact@example.com
5+ enable_stats: False # activate /stats page - note: it may leak usage data
56
67brand:
78 git_url: https://github.com/searx/searx
searx/webapp.py+2
@@ -978,6 +978,8 @@ def image_proxy():
978978@app.route('/stats', methods=['GET'])
979979def stats():
980980 """Render engine statistics page."""
981+ if not settings['general'].get('enable_stats'):
982+ return page_not_found(None)
981983 stats = get_engines_stats(request.preferences)
982984 return render(
983985 'stats.html',