Merge "Horizon: HTTP Verb Tampering vulnerability fix"

horizon/templates/bin/_horizon.sh.tpl

@@ -27,6 +27,8 @@ function start () {
   # wsgi/horizon-http needs open files here, including secret_key_store
   chown -R horizon ${SITE_PACKAGES_ROOT}/openstack_dashboard/local/
 
+  a2enmod rewrite
+
   if [ -f /etc/apache2/envvars ]; then
      # Loading Apache2 ENV variables
      source /etc/apache2/envvars

horizon/values.yaml

@@ -74,6 +74,9 @@ conf:
           WSGIProcessGroup horizon-http
           WSGIScriptAlias / /var/www/cgi-bin/horizon/django.wsgi
           WSGIPassAuthorization On
+          RewriteEngine on
+          RewriteCond %{REQUEST_METHOD} !^(POST|PUT|GET|DELETE)
+          RewriteRule .* - [F]
 
           <Location "/">
               Require all granted