Backup_Repos/filestash
1
0
Fork 0
mirror of https://github.com/mickael-kerjean/filestash synced 2025-12-31 12:55:02 +01:00
Code Issues Projects Releases Wiki Activity

fix (origin): better UX for hostname verification

Browse source
This commit is contained in:
Mickael Kerjean 2022-11-25 16:44:10 +11:00
parent 2b623cac34
commit ea88b6ee14
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
client/pages/adminpage/setup.js
View file

@ -55,6 +55,7 @@ export class SetupPage extends React.Component {
config = FormObjToJSON(config);
config.connections = window.CONFIG.connections;
config.auth.admin = hash;
config.general.host = location.host;
Config.save(config, false)
.then(() => Admin.login(p))
.then(() => this.setState({ busy: false }, done))

12
server/middleware/http.go
View file

@ -80,10 +80,16 @@ func SecureHeaders(fn func(*App, http.ResponseWriter, *http.Request)) func(ctx *
func SecureOrigin(fn func(*App, http.ResponseWriter, *http.Request)) func(ctx *App, res http.ResponseWriter, req *http.Request) {
return func(ctx *App, res http.ResponseWriter, req *http.Request) {
if host := Config.Get("general.host").String(); host != "" {
host = strings.TrimPrefix(host, "http://")
host = strings.TrimPrefix(host, "https://")
if req.Host != host && req.Host != fmt.Sprintf("%s:443", host) {
Log.Error("Request coming from \"%s\" was blocked, only traffic from \"%s\" is allowed. You can change this from the admin console under configure -> host", req.Host, host)
SendErrorResult(res, ErrNotAllowed)
return
if strings.HasPrefix(req.URL.Path, "/admin/") == false {
Log.Error("Request coming from \"%s\" was blocked, only traffic from \"%s\" is allowed. You can change this from the admin console under configure -> host", req.Host, host)
SendErrorResult(res, ErrNotAllowed)
return
} else {
Log.Warning("Access from incorrect hostname. From the admin console under configure -> host, you need to use the following hostname: '%s' current value is '%s' |> URL[%s]", req.Host, host, req.URL.Path)
}
}
}
if req.Header.Get("X-Requested-With") == "XmlHttpRequest" { // Browser XHR Access