Начало Каталог Помощ
Вход
LBP
/
FreshRSS
огледало от https://github.com/FreshRSS/FreshRSS.git
4
0
Разклонения 0
Файлове Задачи 0 Уики
Преглед на файлове

Redirect away from wrong URL paths to fix displaying of relative URLs (#9075)

* Redirect away from wrong URL paths to fix displaying of relative URLs

* Also strip path info for API pages

* Error for API

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Inverle преди 1 седмица
родител
8c5bd58808
ревизия
f2e97b6399
променени са 3 файла, в които са добавени 16 реда и са изтрити 1 реда
Разделен изглед Покажи статистика за разликите
  1. 4 1
      lib/Minz/FrontController.php
  2. 6 0
      p/api/index.php
  3. 6 0
      p/api/query.php

+ 4 - 1
lib/Minz/FrontController.php
Целия файл 

@@ -39,12 +39,15 @@ class Minz_FrontController {
 
 
 			Minz_Request::init();
 
 
+			// Build the current request's URL and forward to it directly.
 
+			// If needed, a redirect is issued instead to correct the public relative path.
 
 			$url = Minz_Url::build();
 
 			$url['params'] = array_merge(
 
 				empty($url['params']) || !is_array($url['params']) ? [] : $url['params'],
 
 				array_filter($_POST, 'is_string', ARRAY_FILTER_USE_KEY)
 
 			);
 
-			Minz_Request::forward($url);
 
+			$pathInfo = $_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '';
 
+			Minz_Request::forward($url, redirect: $pathInfo !== '');
 
 		} catch (Minz_Exception $e) {
 
 			Minz_Log::error($e->getMessage());
 
 			self::killApp($e->getMessage());

+ 6 - 0
p/api/index.php
Целия файл 

@@ -12,6 +12,12 @@ $frameAncestors = FreshRSS_Context::systemConf()->attributeString('csp.frame-anc
 
 header("Content-Security-Policy: default-src 'self'; frame-ancestors $frameAncestors");
 
 header('X-Content-Type-Options: nosniff');
 
 
+if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') {
 
+	// Do not allow trailing slashes
 
+	header('HTTP/1.1 400 Bad Request');
 
+	die('Invalid path!');
 
+}
 
+
 
 Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null));
 
 ?>
 
 <!DOCTYPE html>

+ 6 - 0
p/api/query.php
Целия файл 

@@ -38,6 +38,12 @@ if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_e
 
 	die('Service Unavailable!');
 
 }
 
 
+if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') {
 
+	// Do not allow trailing slashes
 
+	header('HTTP/1.1 400 Bad Request');
 
+	die('Invalid path!');
 
+}
 
+
 
 FreshRSS_Context::initUser($user);
 
 if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
 
 	usleep(rand(100, 10000));	//Primitive mitigation of scanning for users