mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-07-28 15:57:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Redirect away from wrong URL paths to fix displaying of relative URLs (#9075)

Browse Source 
* Redirect away from wrong URL paths to fix displaying of relative URLs

* Also strip path info for API pages

* Error for API

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
This commit is contained in:
Inverle
2026-07-22 19:07:01 +02:00
committed by GitHub
parent 8c5bd58808
commit f2e97b6399
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/Minz/FrontController.php
View File

@@ -39,12 +39,15 @@ class Minz_FrontController {
Minz_Request::init();
// Build the current request's URL and forward to it directly.
// If needed, a redirect is issued instead to correct the public relative path.
$url = Minz_Url::build();
$url['params'] = array_merge(
empty($url['params']) || !is_array($url['params']) ? [] : $url['params'],
array_filter($_POST, 'is_string', ARRAY_FILTER_USE_KEY)
);
Minz_Request::forward($url);
$pathInfo = $_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '';
Minz_Request::forward($url, redirect: $pathInfo !== '');
} catch (Minz_Exception $e) {
Minz_Log::error($e->getMessage());
self::killApp($e->getMessage());

6
p/api/index.php
View File

@@ -12,6 +12,12 @@ $frameAncestors = FreshRSS_Context::systemConf()->attributeString('csp.frame-anc
header("Content-Security-Policy: default-src 'self'; frame-ancestors $frameAncestors");
header('X-Content-Type-Options: nosniff');
if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') {
// Do not allow trailing slashes
header('HTTP/1.1 400 Bad Request');
die('Invalid path!');
}
Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null));
?>
<!DOCTYPE html>

6
p/api/query.php
View File

@@ -38,6 +38,12 @@ if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_e
die('Service Unavailable!');
}
if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') {
// Do not allow trailing slashes
header('HTTP/1.1 400 Bad Request');
die('Invalid path!');
}
FreshRSS_Context::initUser($user);
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
usleep(rand(100, 10000)); //Primitive mitigation of scanning for users