Security Hole: flask_apscheduler.APScheduler.init_app() always adds Jobs UI

[adroffner]

The Jobs UI allows anyone to see the jobs list & run a job ID. There is no authentication scheme to protect the job control. This is a major security hole.

The real problem is APScheduler.init_app() always adds Jobs UI endpoints. Please, add a flag to the constructor & init_app methods so that the Job UI can be left out of the Flask routes (I recommend this as the default).

NOTE:
For now, I am overriding the method to ignore __load_views() so that it doesn't make the routes.

[viniciuschiele]

@adroffner

Definitely that is a good idea, I will add a new flag in the flask config object to enable the views, the default will be False.

e.g:

app.config['APSCHEDULER_VIEWS'] = True

I will try to release a new version today.

Cheers!

[viniciuschiele]

I have added a new flag called SCHEDULER_VIEWS_ENABLED to enable/disable the views, by default it is False.

app.config['SCHEDULER_VIEWS_ENABLED'] = True