From 98c24d288182561637bd847fa55de6d37c272eca Mon Sep 17 00:00:00 2001
From: Volker Theile <vtheile@suse.com>
Date: Mon, 7 Dec 2020 13:56:56 +0100
Subject: [PATCH] mgr/dashboard: Display a warning message in Dashboard when
 debug mode is enabled

Set a health check warning if debug mode is enabled.

Fixes: https://tracker.ceph.com/issues/48475

Signed-off-by: Volker Theile <vtheile@suse.com>
(cherry picked from commit a1aa760acf6c6457f7edc0274a2196cc2f3673c0)
---
 doc/rados/operations/health-checks.rst        | 13 ++++++++
 src/pybind/mgr/dashboard/module.py            | 11 ++++++-
 src/pybind/mgr/dashboard/plugins/debug.py     | 30 +++++++++++++++++--
 .../mgr/dashboard/plugins/interfaces.py       | 10 +++++++
 4 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/doc/rados/operations/health-checks.rst b/doc/rados/operations/health-checks.rst
index 4b3d5a7a2f58e..32169dab333d5 100644
--- a/doc/rados/operations/health-checks.rst
+++ b/doc/rados/operations/health-checks.rst
@@ -1175,3 +1175,16 @@ This warning can silenced by setting the
 ``mon_warn_on_osd_down_out_interval_zero`` to false::
 
   ceph config global mon mon_warn_on_osd_down_out_interval_zero false
+
+DASHBOARD_DEBUG
+_______________
+
+The Dashboard debug mode is enabled. This means, if there is an error
+while processing a REST API request, the HTTP error response contains
+a Python traceback. This behaviour should be disabled in production
+environments because such a traceback might contain and expose sensible
+information.
+
+The debug mode can be disabled with::
+
+  ceph dashboard debug disable
diff --git a/src/pybind/mgr/dashboard/module.py b/src/pybind/mgr/dashboard/module.py
index 6057802ebf0a5..136252e01374c 100644
--- a/src/pybind/mgr/dashboard/module.py
+++ b/src/pybind/mgr/dashboard/module.py
@@ -279,9 +279,9 @@ class Module(MgrModule, CherryPyConfig):
 
         self._stopping = threading.Event()
         self.shutdown_event = threading.Event()
-
         self.ACCESS_CTRL_DB = None
         self.SSO_DB = None
+        self.health_checks = {}
 
     @classmethod
     def can_run(cls):
@@ -426,6 +426,15 @@ class Module(MgrModule, CherryPyConfig):
 
         return self.__pool_stats
 
+    def config_notify(self):
+        """
+        This method is called whenever one of our config options is changed.
+        """
+        PLUGIN_MANAGER.hook.config_notify()
+
+    def refresh_health_checks(self):
+        self.set_health_checks(self.health_checks)
+
 
 class StandbyModule(MgrStandbyModule, CherryPyConfig):
     def __init__(self, *args, **kwargs):
diff --git a/src/pybind/mgr/dashboard/plugins/debug.py b/src/pybind/mgr/dashboard/plugins/debug.py
index d5719157bc44f..e4efa9c747e3b 100644
--- a/src/pybind/mgr/dashboard/plugins/debug.py
+++ b/src/pybind/mgr/dashboard/plugins/debug.py
@@ -21,7 +21,8 @@ class Actions(Enum):
 
 
 @PM.add_plugin  # pylint: disable=too-many-ancestors
-class Debug(SP, I.CanCherrypy, I.ConfiguresCherryPy):  # pylint: disable=too-many-ancestors
+class Debug(SP, I.CanCherrypy, I.ConfiguresCherryPy,  # pylint: disable=too-many-ancestors
+            I.Setupable, I.ConfigNotify):
     NAME = 'debug'
 
     OPTIONS = [
@@ -33,6 +34,26 @@ class Debug(SP, I.CanCherrypy, I.ConfiguresCherryPy):  # pylint: disable=too-man
         )
     ]
 
+    @no_type_check  # https://github.com/python/mypy/issues/7806
+    def _refresh_health_checks(self):
+        debug = self.get_option(self.NAME)
+        if debug:
+            self.mgr.health_checks.update({'DASHBOARD_DEBUG': {
+                'severity': 'warning',
+                'summary': 'Dashboard debug mode is enabled',
+                'detail': [
+                    'Please disable debug mode in production environments using '
+                    '"ceph dashboard {} {}"'.format(self.NAME, Actions.DISABLE.value)
+                ]
+            }})
+        else:
+            self.mgr.health_checks.pop('DASHBOARD_DEBUG', None)
+        self.mgr.refresh_health_checks()
+
+    @PM.add_hook
+    def setup(self):
+        self._refresh_health_checks()
+
     @no_type_check
     def handler(self, action):
         ret = 0
@@ -40,10 +61,11 @@ class Debug(SP, I.CanCherrypy, I.ConfiguresCherryPy):  # pylint: disable=too-man
         if action in [Actions.ENABLE.value, Actions.DISABLE.value]:
             self.set_option(self.NAME, action == Actions.ENABLE.value)
             self.mgr.update_cherrypy_config({})
+            self._refresh_health_checks()
         else:
             debug = self.get_option(self.NAME)
             msg = "Debug: '{}'".format('enabled' if debug else 'disabled')
-        return (ret, msg, None)
+        return ret, msg, None
 
     COMMANDS = [
         SP.Command(
@@ -70,3 +92,7 @@ class Debug(SP, I.CanCherrypy, I.ConfiguresCherryPy):  # pylint: disable=too-man
             'environment': 'test_suite' if self.get_option(self.NAME) else 'production',
             'error_page.default': self.custom_error_response,
         })
+
+    @PM.add_hook
+    def config_notify(self):
+        self._refresh_health_checks()
diff --git a/src/pybind/mgr/dashboard/plugins/interfaces.py b/src/pybind/mgr/dashboard/plugins/interfaces.py
index f9169a0d89a6e..d0af7eeabbaf0 100644
--- a/src/pybind/mgr/dashboard/plugins/interfaces.py
+++ b/src/pybind/mgr/dashboard/plugins/interfaces.py
@@ -68,3 +68,13 @@ class FilterRequest(object):
         @PM.add_abcspec
         def filter_request_before_handler(self, request):
             pass
+
+
+@PM.add_interface
+class ConfigNotify(Interface):
+    @PM.add_abcspec
+    def config_notify(self):
+        """
+        This method is called whenever a option of this mgr module has
+        been modified.
+        """
-- 
2.39.5