Extend web_client_location to handle absolute URLs (#7006)
Log warning when filesystem path is used.
Signed-off-by: Martin Milata <martin@martinmilata.cz>
2 files changed, 21 insertions, 6 deletions
diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py
index f2b56a636f..49df63acd0 100644
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -241,16 +241,26 @@ class SynapseHomeServer(HomeServer):
resources[SERVER_KEY_V2_PREFIX] = KeyApiV2Resource(self)
if name == "webclient":
- webclient_path = self.get_config().web_client_location
+ webclient_loc = self.get_config().web_client_location
- if webclient_path is None:
+ if webclient_loc is None:
logger.warning(
"Not enabling webclient resource, as web_client_location is unset."
)
+ elif webclient_loc.startswith("http://") or webclient_loc.startswith(
+ "https://"
+ ):
+ resources[WEB_CLIENT_PREFIX] = RootRedirect(webclient_loc)
else:
+ logger.warning(
+ "Running webclient on the same domain is not recommended: "
+ "https://github.com/matrix-org/synapse#security-note - "
+ "after you move webclient to different host you can set "
+ "web_client_location to its full URL to enable redirection."
+ )
# GZip is disabled here due to
# https://twistedmatrix.com/trac/ticket/7678
- resources[WEB_CLIENT_PREFIX] = File(webclient_path)
+ resources[WEB_CLIENT_PREFIX] = File(webclient_loc)
if name == "metrics" and self.get_config().enable_metrics:
resources[METRICS_PREFIX] = MetricsResource(RegistryProxy)
diff --git a/synapse/config/server.py b/synapse/config/server.py
index 7525765fee..28e2a031fb 100644
--- a/synapse/config/server.py
+++ b/synapse/config/server.py
@@ -604,10 +604,15 @@ class ServerConfig(Config):
#
pid_file: %(pid_file)s
- # The path to the web client which will be served at /_matrix/client/
- # if 'webclient' is configured under the 'listeners' configuration.
+ # The absolute URL to the web client which /_matrix/client will redirect
+ # to if 'webclient' is configured under the 'listeners' configuration.
#
- #web_client_location: "/path/to/web/root"
+ # This option can be also set to the filesystem path to the web client
+ # which will be served at /_matrix/client/ if 'webclient' is configured
+ # under the 'listeners' configuration, however this is a security risk:
+ # https://github.com/matrix-org/synapse#security-note
+ #
+ #web_client_location: https://riot.example.com/
# The public-facing base URL that clients use to access this HS
# (not including _matrix/...). This is the same URL a user would
|
