Merge branch 'tweak/http-timeout' into 'dev'

HTTP Timeout

See merge request crafty-controller/crafty-4!704

CHANGELOG.md

@@ -7,6 +7,7 @@
 ### Refactor
 - Refactor subpage perm checks ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/695))
 ### Bug fixes
+- [`CVE-2024-1064`] Security-related fix to resolve an issue with the HTTP listener ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/704))
 - Fix bukkit and downstream fork MOTD crash ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/686))
 - Fix bug where invalid server Id leads to stack ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/690))
 - Fix indent on public status check box ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/691))

app/classes/web/http_handler.py

@@ -17,7 +17,7 @@ class HTTPHandler(BaseHandler):
             url = "https://" + url
         db_port = self.helper.get_setting("https_port")
         try:
-            resp = requests.get(url + ":" + str(port))
+            resp = requests.head(url + ":" + str(port), timeout=(0.5, 5))
             resp.raise_for_status()
         except Exception:
             port = db_port
@@ -35,7 +35,7 @@ class HTTPHandlerPage(BaseHandler):
             url = "https://" + url
         db_port = self.helper.get_setting("https_port")
         try:
-            resp = requests.get(url + ":" + str(port))
+            resp = requests.head(url + ":" + str(port), timeout=(0.5, 5))
             resp.raise_for_status()
         except Exception:
             port = db_port

app/classes/web/http_handler_page.py

@@ -25,7 +25,7 @@ class HTTPHandlerPage(BaseHandler):
             backup_url = url + str(self.helper.get_setting("https_port"))
 
         try:
-            resp = requests.get(primary_url)
+            resp = requests.head(primary_url, timeout=(0.5, 5))
             resp.raise_for_status()
             url = primary_url
         except Exception:

app/classes/web/tornado_handler.py

@@ -112,7 +112,7 @@ class Webserver:
             cookie_secret = self.helper.random_string_generator(32)
             HelpersManagement.set_cookie_secret(cookie_secret)
 
-        if not http_port:
+        if not http_port and http_port != 0:
             http_port = 8000
 
         if not https_port:
@@ -191,8 +191,11 @@ class Webserver:
             serve_traceback=debug_errors,
         )
 
-        self.http_server = tornado.httpserver.HTTPServer(http_app)
-        self.http_server.listen(http_port)
+        if http_port != 0:
+            self.http_server = tornado.httpserver.HTTPServer(http_app)
+            self.http_server.listen(http_port)
+        else:
+            logger.info("http port disabled by config")
 
         self.https_server = tornado.httpserver.HTTPServer(app, ssl_options=cert_objects)
         self.https_server.listen(https_port)