# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1570209372 -7200
# Node ID cac8ffcb9cef7e0202f496f541520b480716a784
# Parent  2090ec6a83a5131915400e3cce2e396b7c53e06d
forcing AuthenticationEnabled to false is considered as insecure if remote access is allowed

diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancExplorer/explorer.html
--- a/OrthancExplorer/explorer.html	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancExplorer/explorer.html	Fri Oct 04 19:16:12 2019 +0200
@@ -652,7 +652,8 @@
       <h1>Insecure setup</h1>
       <p>
         Your Orthanc server is accepting remote connections, but is
-	using the default username and password. Please carefully read
+	using the default username and password, or has user
+	authentication explicitly turned off. Please carefully read
 	your logs and review your configuration, especially
 	options <tt>RemoteAccessAllowed</tt>, <tt>AuthenticationEnabled</tt>,
 	and <tt>RegisteredUsers</tt>.
diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancExplorer/explorer.js
--- a/OrthancExplorer/explorer.js	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancExplorer/explorer.js	Fri Oct 04 19:16:12 2019 +0200
@@ -395,8 +395,8 @@
       }
 
       // New in Orthanc 1.5.8
-      if ('IsDefaultUser' in s &&
-          s.IsDefaultUser) {
+      if ('IsHttpServerSecure' in s &&
+          !s.IsHttpServerSecure) {
         $('.warning-insecure').show();
       } else {
         $('.warning-insecure').hide();
diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancServer/OrthancRestApi/OrthancRestSystem.cpp
--- a/OrthancServer/OrthancRestApi/OrthancRestSystem.cpp	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancServer/OrthancRestApi/OrthancRestSystem.cpp	Fri Oct 04 19:16:12 2019 +0200
@@ -60,7 +60,7 @@
     result["ApiVersion"] = ORTHANC_API_VERSION;
     result["Version"] = ORTHANC_VERSION;
     result["DatabaseVersion"] = OrthancRestApi::GetIndex(call).GetDatabaseVersion();
-    result["IsDefaultUser"] = context.IsDefaultUser();  // New in Orthanc 1.5.8
+    result["IsHttpServerSecure"] = context.IsHttpServerSecure();  // New in Orthanc 1.5.8
 
     {
       OrthancConfiguration::ReaderLock lock;
diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancServer/ServerContext.cpp
--- a/OrthancServer/ServerContext.cpp	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancServer/ServerContext.cpp	Fri Oct 04 19:16:12 2019 +0200
@@ -240,7 +240,7 @@
     haveJobsChanged_(false),
     isJobsEngineUnserialized_(false),
     metricsRegistry_(new MetricsRegistry),
-    isDefaultUser_(false)
+    isHttpServerSecure_(true)
   {
     {
       OrthancConfiguration::ReaderLock lock;
diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancServer/ServerContext.h
--- a/OrthancServer/ServerContext.h	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancServer/ServerContext.h	Fri Oct 04 19:16:12 2019 +0200
@@ -220,7 +220,7 @@
     bool saveJobs_;
 
     std::auto_ptr<MetricsRegistry>  metricsRegistry_;
-    bool isDefaultUser_;
+    bool isHttpServerSecure_;
 
   public:
     class DicomCacheLocker : public boost::noncopyable
@@ -404,14 +404,14 @@
       return *metricsRegistry_;
     }
 
-    void SetDefaultUser(bool isDefaultUser)
+    void SetHttpServerSecure(bool isSecure)
     {
-      isDefaultUser_ = isDefaultUser;
+      isHttpServerSecure_ = isSecure;
     }
 
-    bool IsDefaultUser() const
+    bool IsHttpServerSecure() const
     {
-      return isDefaultUser_;
+      return isHttpServerSecure_;
     }
   };
 }
diff -r 2090ec6a83a5 -r cac8ffcb9cef OrthancServer/main.cpp
--- a/OrthancServer/main.cpp	Fri Oct 04 17:41:43 2019 +0200
+++ b/OrthancServer/main.cpp	Fri Oct 04 19:16:12 2019 +0200
@@ -824,6 +824,9 @@
       httpServer.SetHttpCompressionEnabled(lock.GetConfiguration().GetBooleanParameter("HttpCompressionEnabled", true));
       httpServer.SetTcpNoDelay(lock.GetConfiguration().GetBooleanParameter("TcpNoDelay", true));
 
+      // Let's assume that the HTTP server is secure
+      context.SetHttpServerSecure(true);
+
       bool authenticationEnabled;
       if (lock.GetConfiguration().LookupBooleanParameter(authenticationEnabled, "AuthenticationEnabled"))
       {
@@ -833,7 +836,8 @@
             !authenticationEnabled)
         {
           LOG(WARNING) << "====> Remote access is enabled while user authentication is explicitly disabled, "
-                       << "make sure this does not affect the security of your setup <====";
+                       << "your setup is POSSIBLY INSECURE <====";
+          context.SetHttpServerSecure(false);
         }
       }
       else if (httpServer.IsRemoteAccessAllowed())
@@ -867,11 +871,11 @@
            * used in Docker images "jodogne/orthanc",
            * "jodogne/orthanc-plugins" and "osimis/orthanc".
            **/
-          LOG(ERROR) << "====> HTTP authentication is enabled, but no user is declared. "
-                     << "Creating a default user: Review your configuration option \"RegisteredUsers\". "
-                     << "Your setup is INSECURE <====";
+          LOG(WARNING) << "====> HTTP authentication is enabled, but no user is declared. "
+                       << "Creating a default user: Review your configuration option \"RegisteredUsers\". "
+                       << "Your setup is INSECURE <====";
 
-          context.SetDefaultUser(true);
+          context.SetHttpServerSecure(false);
 
           // This is the username/password of the default user in Orthanc.
           httpServer.RegisterUser("orthanc", "orthanc");
@@ -882,11 +886,6 @@
                        << "check the value of configuration option \"RegisteredUsers\"";
         }
       }
-      else
-      {
-        // This setup is secure
-        context.SetDefaultUser(false);
-      }
       
       if (lock.GetConfiguration().GetBooleanParameter("SslEnabled", false))
       {