diff --git a/settings.json.template b/settings.json.template index fcec98c84..ff1359933 100644 --- a/settings.json.template +++ b/settings.json.template @@ -50,6 +50,9 @@ /* This setting is used if you need http basic auth */ // "httpAuth" : "user:pass", + /* This setting is used for http basic auth for admin pages */ + "adminHttpAuth" : "user:pass", + /* The log level we are using, can be: DEBUG, INFO, WARN, ERROR */ "loglevel": "INFO", diff --git a/src/node/hooks/express/webaccess.js b/src/node/hooks/express/webaccess.js index 8e9f967a9..e77e133c4 100644 --- a/src/node/hooks/express/webaccess.js +++ b/src/node/hooks/express/webaccess.js @@ -6,11 +6,19 @@ var settings = require('../../utils/Settings'); //checks for basic http auth exports.basicAuth = function (req, res, next) { + var pass = settings.httpAuth; + if (req.path.indexOf('/admin') == 0) { + var pass = settings.adminHttpAuth; + } + // Just pass if not activated in Activate http basic auth if it has been defined in settings.json + if (!pass) { + return next(); + } + if (req.headers.authorization && req.headers.authorization.search('Basic ') === 0) { // fetch login and password - if (new Buffer(req.headers.authorization.split(' ')[1], 'base64').toString() == settings.httpAuth) { - next(); - return; + if (new Buffer(req.headers.authorization.split(' ')[1], 'base64').toString() == pass) { + return next(); } } @@ -25,8 +33,7 @@ exports.basicAuth = function (req, res, next) { } exports.expressConfigure = function (hook_name, args, cb) { - // Activate http basic auth if it has been defined in settings.json - if(settings.httpAuth != null) args.app.use(exports.basicAuth); + args.app.use(exports.basicAuth); // If the log level specified in the config file is WARN or ERROR the application server never starts listening to requests as reported in issue #158. // Not installing the log4js connect logger when the log level has a higher severity than INFO since it would not log at that level anyway. diff --git a/src/node/utils/Settings.js b/src/node/utils/Settings.js index 24237de49..12fcc55c5 100644 --- a/src/node/utils/Settings.js +++ b/src/node/utils/Settings.js @@ -85,6 +85,11 @@ exports.loglevel = "INFO"; */ exports.httpAuth = null; +/** + * Http basic auth, with "user:password" format + */ +exports.adminHttpAuth = null; + //checks if abiword is avaiable exports.abiwordAvailable = function() {