Make administration GUI accessible without query URL

RainLoop / rainloop-webmail

Simple, modern & fast web-based email client

http://rainloop.net

MIT License

4.11k stars 893 forks source link

Make administration GUI accessible without query URL #1053

Open 1resu opened 8 years ago

1resu commented 8 years ago

Hi, the admin GUI is only accessible via a query (/?admin). That makes it hard to protect this URL by a .htaccess rule or similar.

Could you please implement it without the query?

Thanks a lot.

extremeshok commented 8 years ago

Actually it is just as easy to limit access to the /?admin nginx

server {
[...]
if ($query_string ~ "admin") {
   allow 1.1.1.1;
   deny all;
}

1resu commented 8 years ago

I asume most of the setups use rainloop beneath an existing domain, e.g. https://domain/rainloop. Then you have to put the if statement in a nginx location block, which is not recommended. So this is not an option.

Also this isn't possbile with Apache.

madpsy commented 7 years ago

It is possible with ModRewite in Apache (REMOTE_ADDR/QUERY_STRING). It's also possible with HAProxy.