Merge "Add LimitRequestBody configuration for Horizon"

This commit is contained in:
Zuul 2023-04-03 10:25:55 +00:00 committed by Gerrit Code Review
commit 3e556dad61
2 changed files with 12 additions and 0 deletions
ansible/roles/horizon/templates
releasenotes/notes

@ -40,6 +40,9 @@ TraceEnable off
SSLCertificateFile /etc/horizon/certs/horizon-cert.pem
SSLCertificateKeyFile /etc/horizon/certs/horizon-key.pem
{% endif %}
{% if horizon_httpd_limitrequestbody is defined %}
LimitRequestBody {{ horizon_httpd_limitrequestbody }}
{% endif %}
</VirtualHost>
<IfModule mod_deflate.c>

@ -0,0 +1,9 @@
---
features:
- |
Since CVE-2022-29404 is fixed the default value for the LimitRequestBody
directive in the Apache HTTP Server has been changed from 0 (unlimited) to
1073741824 (1 GiB). This limits the size of images (for example) uploaded
in Horizon. Now this limit can be configured via
``horizon_httpd_limitrequestbody``.
`LP#2012588 <https://bugs.launchpad.net/kolla-ansible/+bug/2012588>`__