Add ood directory whitelist option (#1775)

* config setting for file browser path whitelist * variable name change in ood 3.0 * fix ansible syntax
Azure · Nov 28, 2023 · 0041931 · 0041931
1 parent ea56740
commit 0041931
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 0 deletions.
diff --git a/config.schema.json b/config.schema.json
@@ -1004,6 +1004,7 @@
                 "name": { "type": "string", "default": "ondemand", "maxLength": 15, "pattern": "[0-9a-z\\-]+" },
                 "generate_certificate": { "type": "boolean", "default": true },
                 "fqdn": { "type": "string" },
+                "whitelist_path": { "type": "string" },
                 "file_upload_max": { "type": "integer" },
                 "file_upload_allowed_extensions": { "type": "array" }
             },

diff --git a/config.tpl.yml b/config.tpl.yml
@@ -233,6 +233,7 @@ ondemand:
   vm_size: Standard_D4s_v5
   #fqdn: azhop.foo.com # When provided it will be used for the certificate server name
   generate_certificate: true # Generate an SSL certificate for the OnDemand portal. Default to true
+  #whitelist_path: "{{mounts.home.mountpoint}}:/tmp" # Optional: colon-separated list of paths allowed in the file browser
   #file_upload_max: 2048 # Maximum file upload size in bytes. Optional, default: 10GB
   #file_upload_allowed_extensions: [".txt", ".log"] # List of allowed file extensions. Default: all files are allowed
 # Grafana VM configuration

diff --git a/docs/deploy/index.md b/docs/deploy/index.md
@@ -608,6 +608,7 @@ ondemand:
   vm_size: Standard_D4s_v5
   #fqdn: azhop.foo.com # When provided it will be used for the certificate server name
   generate_certificate: true # Generate an SSL certificate for the OnDemand portal. Default to true
+  #whitelist_path: "{{mounts.home.mountpoint}}:/tmp" # Optional: colon-separated list of paths allowed in the file browser
   #file_upload_max: 2048 # Maximum file upload size in bytes. Optional, default: 10GB
   #file_upload_allowed_extensions: [".txt", ".log"] # List of allowed file extensions. Default: all files are allowed
 # Grafana VM configuration

diff --git a/playbooks/ood-overrides-common.yml b/playbooks/ood-overrides-common.yml
@@ -93,6 +93,7 @@ pun_custom_env:
   OOD_BRAND_BG_COLOR: "#0078d4"
   OOD_BRAND_LINK_ACTIVE_BG_COLOR: "#212529"
   OOD_JOB_NAME_ILLEGAL_CHARS: "/"
+  OOD_ALLOWLIST_PATH: "{{ondemand.whitelist_path | default('/')}}"
 
 # See https://osc.github.io/ood-documentation/latest/customization.html#pinning-applications-to-the-dashboard
 pinned_apps: