---
- name: "Verify redirect value and fail"
  fail: msg="Redirect should be a complete URL, not {{ redirect }}"
  when: "redirect is defined and not redirect | match('^https?://')"

- include: common.yml
  when: httpd_common is not defined

- set_fact: httpd_common=True

- file: state=directory path={{ document_root }} setype=httpd_sys_content_t owner=root mode=755 group=root
  when: document_root is defined

- file:  path=/etc/httpd/conf.d/{{ website_url }}.conf.d/ state=directory
  when: website_url is defined

# needed for newer apache, who requires at least 1 file for include
- copy: dest=/etc/httpd/conf.d/{{ website_url }}.conf.d/placeholder.conf content="# Placeholder"
  when: website_url is defined

- htpasswd: path=/etc/httpd/{{ website_url }}.htpasswd name={{ website_user }} password={{ website_password }} owner=root group=apache mode=0640
  when: website_user is defined

- template: src=vhost.conf dest=/etc/httpd/conf.d/{{ website_url }}.conf owner=root group=apache mode=0644
  notify: verify config and restart httpd
  when: document_root is defined

- template: src=vhost_redirect.conf dest=/etc/httpd/conf.d/{{ website_url }}.conf owner=root group=apache mode=0644
  notify: verify config and restart httpd
  when: redirect is defined

---
- name: "Verify redirect value and fail"
  fail: msg="Redirect should be a complete URL, not {{ redirect }}"
  when: "redirect is defined and not redirect | match('^https?://.*/')"

- include: common.yml
  when: httpd_common is not defined

- set_fact: httpd_common=True

- file: state=directory path={{ document_root }} setype=httpd_sys_content_t owner=root mode=755 group=root
  when: document_root is defined

- file:  path=/etc/httpd/conf.d/{{ website_url }}.conf.d/ state=directory
  when: website_url is defined

# needed for newer apache, who requires at least 1 file for include
- copy: dest=/etc/httpd/conf.d/{{ website_url }}.conf.d/placeholder.conf content="# Placeholder"
  when: website_url is defined

- htpasswd: path=/etc/httpd/{{ website_url }}.htpasswd name={{ website_user }} password={{ website_password }} owner=root group=apache mode=0640
  when: website_user is defined

- template: src=vhost.conf dest=/etc/httpd/conf.d/{{ website_url }}.conf owner=root group=apache mode=0644
  notify: verify config and restart httpd
  when: document_root is defined

- template: src=vhost_redirect.conf dest=/etc/httpd/conf.d/{{ website_url }}.conf owner=root group=apache mode=0644
  notify: verify config and restart httpd
  when: redirect is defined

Make sure the redirection is safe and cannot be abused
Make sure the redirection is safe and cannot be abused

RH infosec team notified me that some people do
use incomplete redirection to construct specific URL when
the redirection do not include a trailling slash.

For example, a redirection from example.org to www.example.org
might be used as example.org/.example.com to
www.example.org.example.com, and a user or a filter would see the
redirection is incorrect. See a example on
http://git.theopensourceway.org/cgit/ansible/commit/?id=20b224a7d5cd8d4142b86ff657ffcd1a4fd30340
