* Rename SiteConfig
* More renaming
* Update spec
* Update mandatory settings mapping
* More renaming
* e2e test fixes
* You have a rename, and you have a rename
* Spec fix
* More changes
* Temporarily disable specs
* After-merge update
* Undo rename for migration
* undo rename of DUS
* Fix DUS
* Fix merge problem
* Remove redundant DUS
* Fix specs
* Remove unused code
* Change wrong class name
* More cleanup
* Re-add missing values to constant
* Fix constant
* Fix spec
* Remove obsolete fields
* Add accidentally removed field
* Update spec
* Move methods from Settings::General to ForemInstance
* Remove unneeded model
* Change mentions of 'site config'
* This change allows access to api/health_checks if you are coming from localhost
or 127.0.0.1. Pretty sweet huh?
The reason for this change is because I want to easily get to these healthcheck
end points from localhost without having to get the health-check-token beforehand.
Buttttt.... this addition has some issues. You can spoof the host header pretty
easily:
https://daniel.haxx.se/blog/2018/04/05/curl-another-host/
I thought about doing `return if !request.ssl? && request.local?`
to check of the request was over https or not. Any localhost healthcheck we do
directly to puma will be over http. Checking for TLS seemed like a logical next
check, but since we force https on the edge and not necessarily from the edge to
Puma the Host header can still be spoofed to get at these end points.
More info on host header attacks and what Rails 6 is doing about it:
https://github.com/rails/rails/issues/29893
While I do think it is a good idea to protect these healthcheck end points from
the outside world, I do want to be able to get to them easily locally. WWYD?
* Fix Health Check spec by stubbing request
Co-authored-by: mstruve <mollylbs@gmail.com>
