diff options
Diffstat (limited to 'rt/etc/RT_Config.pm')
| -rw-r--r-- | rt/etc/RT_Config.pm | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/rt/etc/RT_Config.pm b/rt/etc/RT_Config.pm index f3c86b267..938d5fc13 100644 --- a/rt/etc/RT_Config.pm +++ b/rt/etc/RT_Config.pm @@ -1274,6 +1274,29 @@ requirements. Set($WebHttpOnlyCookies, 1); +=item C<$RestrictReferrer> + +If set to a false value, the HTTP C<Referer> (sic) header will not be +checked to ensure that requests come from RT's own domain. As RT allows +for GET requests to alter state, disabling this opens RT up to +cross-site request forgery (CSRF) attacks. + +=cut + +Set($RestrictReferrer, 1); + +=item C<$RestrictLoginReferrer> + +If set to a false value, RT will allow the user to log in from any link +or request, merely by passing in C<user> and C<pass> parameters; setting +it to a true value forces all logins to come from the login box, so the +user is aware that they are being logged in. The default is off, for +backwards compatability. + +=cut + +Set($RestrictLoginReferrer, 0); + =item C<$WebFlushDbCacheEveryRequest> By default, RT clears its database cache after every page view. @@ -1758,6 +1781,23 @@ Should rejection notes be sent to the requestors? The default is true. Set($ApprovalRejectionNotes, 1); +=item C<@ReferrerWhitelist> + +This is a list of hostname:port combinations that RT will treat as being +part of RT's domain. This is particularly useful if you access RT as +multiple hostnames or have an external auth system that needs to +redirect back to RT once authentication is complete. + + Set(@ReferrerWhitelist, qw(www.example.com:443 www3.example.com:80)); + +If the "RT has detected a possible cross-site request forgery" error is triggered +by a host:port sent by your browser that you believe should be valid, you can copy +the host:port from the error message into this list. + +=cut + +Set(@ReferrerWhitelist, qw()); + =back =head1 Miscellaneous Configuration |