Connection must originate on localhost

[amp-cli]

Connection must originate on localhost

[totten]

OK, so it looks like we're talking about canary.php -- which is generated by TestCommand and installed on the test site as part of an end-to-end test:

https://github.com/totten/amp/blob/30aaa0f94/src/Amp/Command/TestCommand.php#L103
https://github.com/totten/amp/blob/30aaa0f94/src/Amp/views/canary.php#L6

The script does some incautious things -- e.g. it accepts a MySQL DSN from $_POST and connects to it -- and that could be abused (e.g to launch DoS) if some bug or accident caused the file to show up on a public httpd. So the script includes the localhost check to prevent abuse by third-parties.

We could change the mechanism for passing DSN (e.g. pass it the same way we pass $dataDir or $autoloader)... Do you think the script would be secure enough that it would be OK if (through bug or accident) it got exposed on a public URL? If so, we could remove the REMOTE_ADDR check entirely.

Aside: I'm kind of curious what use-case you have in which REMOTE_ADDR is not localhost...

[JKingsnorth]

Hi totten. Sorry, I may have misidentified the issue. I'm done some more testing this morning and I'm getting an access denied even before it manages to get into the script, so I expect this is a boreader permissions issue on my server.

The REMOTE_ADDR is only set if you're accessing from localhost, but not using the command line. Since I was debugging the file using the command line, the REMOTE_ADDR wasn't set, so it was hitting this error. That sent me off course a bit.

Thanks for the comments though. I think the localhost check should probably stay in place for security, as you mention.

[JKingsnorth]

Silly me, I was trying to include the file before the <Directory />, and there were permissions to fix up as well. Sorry for the false alarm totten, but thanks for the help.