Basic Auth via Apache Proxy: ethercalc --key always redirects to /edit instead of /view?

[crubb]

Hey guys,

I'm trying to set up basic auth according to #1 and #4. As soon as I provide a --key on the command line and go to one of my spreadsheets I always get automatically redirected to /edit instead of /view - Even when I delete all my browser's cache, restart apache and ethercalc. Did an npm update just today, but it already happened before the update.

Can you give me any hints?

Apache Config

<Directory "/home/ethercalc/node_modules/ethercalc/">
  Options FollowSymlinks
  AllowOverride None
  Require all granted
</Directory>

RewriteEngine On

# Proxy pass to the node.js server (port 8000)
ProxyPass /.well-known/ !
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/

# Set up websockets to work through the proxy
RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
RewriteCond %{QUERY_STRING} transport=websocket    [NC]
RewriteRule /(.*)           ws://localhost:8000/$1 [P,L]

<LocationMatch "^/">
  AuthType Basic
  AuthName "Ethercalc Viewer"
  AuthUserFile "/var/www/.../.htpasswd"
  Require valid-user
  Order allow,deny
  Allow from all
</LocationMatch>

<LocationMatch ^/(.*)/edit$>
  AuthType Basic
  AuthName "Ethercalc Viewer"
  AuthUserFile "/var/www/.../.htpasswd"
  Require user admin
  Order allow,deny
  Allow from all
</LocationMatch>

# For letsencrypt
<LocationMatch "^/.well-known/">
  AuthType None
  Require all granted
</LocationMatch>

# Set up an alias for static files. Saves having to serve them from node.js
Alias /static /home/ethercalc/node_modules/ethercalc/static
Alias /l10n /home/ethercalc/node_modules/ethercalc/l10n
Alias /images /home/ethercalc/node_modules/ethercalc/images

Command line

/home/ethercalc/node_modules/ethercalc/bin/ethercalc --host 127.0.0.1 --key ThisIsASecret57592

Any hints would be greatly appreciated.

Thank you!

Best regards,
crubb

[crubb]

Can anybody confirm/reproduce my problem?

[eddyparkinson]

How do you tell it to view, like this?
http://sheet.cellmaster.com.au/carbonoffset/view

also - when I run from command line, I use:
node app.js

[crubb]

I thought that when calling http://sheet.cellmaster.com.au/carbonoffset/ without /view, it should automatically redirect to /view when --key is supplied? Source: #1 (comment)

[eddyparkinson]

http://sheet.cellmaster.com.au/carbonoffset would be the same as http://sheet.cellmaster.com.au/carbonoffset/edit

[crubb]

Hey eddyparkinson,

I would expect differently, as documented in #1 (comment):

To enable this mode, start ethercalc with a "--key" parameter:

  ./bin/ethercalc --key 85b5dd7a-8afe-11e1-bca8-002332d309a4

Under this mode, /:room simply redirects to the /:room/view URL.

[eddyparkinson]

I have not checked this, but maybe change

else @response.redirect "#BASEPATH/#{ @params.room }?auth=0"

to

else @response.redirect "#BASEPATH/#{ @params.room }?auth=0&view=1"

Here:
https://github.com/audreyt/ethercalc/blob/master/src/main.ls#L244-L250

Background. I know the view code was not working at all about 1.5 years ago, so I put
a fix in, but I did not update this feature.

[cenotaph]

I'm also having this problem. Trying the fix eddyparkinson suggested on line 249 just results in an infinite redirect loop.

I'm not great with Livescript or JS in general so I'd love to help because I think this is a pretty important thing to have working (or, at least, remove --key from the README as a feature). We'd like to use ethercalc in production at our organisation but cannot until we can reliably protect pages.

[dreirund]

Same problem here.

[eddyparkinson]

Have you looked at ethercalc on sandstorm.io - not sure what you need but it does control access to sheets and do sharing

[dreirund]

Have you looked at ethercalc on sandstorm.io - not sure what you need but it does control access to sheets and do sharing

I did not install any sandstorm.io -- it is even so much more stuff than ethercalc needs. I am sceptic about node.js anyway (why not run it via the webserver with CGI or PHP but why another process needs to put up a server???), so I am not doing to install this huge thing.

Working --key argument, working --basepath argument, viewing tables only with [...]/view, editing only with [...]/edit and the rest can be done via webserver config would be sufficient. ethercalc just needs to be fixed for this. See also Issue 668.

[eddyparkinson]

I am sceptic about node.js anyway

all the spreadsheet formulae are in js - this means calculations can be done on the server, not just the client.

But I do have a version that runs without node.js. It is just not able to save anything.

ethercalc just needs to be fixed

Pull requests are always most welcome.

Would be good if someone had a few spare months to fix these, as people do want them fixed.