Bug#777546: Please don't grant localhost unconditional access to mod_status

[Stefan Fritsch <sf@sfritsch.de>]

On Monday 09 February 2015 16:34:02, Jean-Michel Nirgal Vourgère 
wrote:
> What is your opinion on that problem?

That's a valid feature request. But for after jessie.

> Do you see a more generic way to restrict tor incoming connections
> so that it doesn't match "require local" filter?

I don't have the perfect idea right now.

One could configure an additional localhost address like 127.0.0.2, 
make the tor hidden service forward to that ip, and change mod_status' 
config to explicitly require 127.0.0.1. But one still needs to change 
the config because "require local" matches 127.0.0.0/8.