HostMonitor: Web Interface 2.0 issue behind reverse proxy

[benjamin.kostner]

We're running Hostmonitor 9.84 on a server machine inside our server DMZ. The webinterface is accessible through a reverse proxy. When the interface is called via the reverse proxy, the interface data does not load.

After digging a bit in the JS files, I may have found a lead to the issue we encounter.

Our server setup is as follows:

The Webservice runs under this URL:

Code: Select all

http://hostmonitor.ourdomain.local:8081/

The reverse proxy URL is:

Code: Select all

https://ourpublichost.at/hmadmin/

Apache has a reverseproxy rule to put all requests to /hmadmin/.* through to http://hostmonitor.ourdomain.local:8081/

This seems to work fine, except the XHRs from Javascript are called with a wrong URL, for example:

Code: Select all

https://ourpublichost.at/data_update.txt?js=1&fid=-1&synctime=-1&ts=1396447148123

instead of

Code: Select all

https://ourpublichost.at/hmadmin/data_update.txt?js=1&fid=-1&synctime=-1&ts=1396447148123

The problem seems to be in the paths used in e.g. tabs.js. There the URLs are prefixed with "../" as in "../data_update.txt" instead of calling "data_update.txt" (relatively to the called html page).

Internally, that works, because:

Code: Select all

http://hostmonitor.ourdomain.local:8081/" + ../data_update.txt => http://hostmonitor.ourdomain.local:8081/data_update.txt
http://hostmonitor.ourdomain.local:8081/ + ../../data_update.txt => http://hostmonitor.ourdomain.local:8081/data_update.txt

But with the reverse proxy in between this results in paths outside the /hmadmin/ base dir:

Code: Select all

https://ourpublichost.at/hmadmin/ + ../data_update.txt => https://ourpublichost.at/data_update.txt
https://ourpublichost.at/ + ../../data_update.txt => https://ourpublichost.at/data_update.txt

Is there a way to work around this problem or is this an issue with the current WebService of Advanced Host Monitor?

For the root page / or /index.htm it seems that the "../"-prefixes could be dropped in the JS without side effects, as the XHR-URLs are built relatively to the document they are called from, not the JS file they are called from.[/code]

[KS-Soft]

There is update
www.ks-soft.net/download/hm984c.exe

Regards
Alex

[mp1]

Thanks Thanks ... that's great

Martin