diff --git a/lib/Minz/FrontController.php b/lib/Minz/FrontController.php index 756885ffe..566281f00 100644 --- a/lib/Minz/FrontController.php +++ b/lib/Minz/FrontController.php @@ -39,12 +39,15 @@ class Minz_FrontController { Minz_Request::init(); + // Build the current request's URL and forward to it directly. + // If needed, a redirect is issued instead to correct the public relative path. $url = Minz_Url::build(); $url['params'] = array_merge( empty($url['params']) || !is_array($url['params']) ? [] : $url['params'], array_filter($_POST, 'is_string', ARRAY_FILTER_USE_KEY) ); - Minz_Request::forward($url); + $pathInfo = $_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? ''; + Minz_Request::forward($url, redirect: $pathInfo !== ''); } catch (Minz_Exception $e) { Minz_Log::error($e->getMessage()); self::killApp($e->getMessage()); diff --git a/p/api/index.php b/p/api/index.php index 03db02188..7433bdf84 100644 --- a/p/api/index.php +++ b/p/api/index.php @@ -12,6 +12,12 @@ $frameAncestors = FreshRSS_Context::systemConf()->attributeString('csp.frame-anc header("Content-Security-Policy: default-src 'self'; frame-ancestors $frameAncestors"); header('X-Content-Type-Options: nosniff'); +if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') { + // Do not allow trailing slashes + header('HTTP/1.1 400 Bad Request'); + die('Invalid path!'); +} + Minz_Translate::init(Minz_Translate::getLanguage(null, Minz_Request::getPreferredLanguages(), null)); ?> diff --git a/p/api/query.php b/p/api/query.php index 2f9a732de..c937476e9 100644 --- a/p/api/query.php +++ b/p/api/query.php @@ -38,6 +38,12 @@ if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_e die('Service Unavailable!'); } +if (($_SERVER['PATH_INFO'] ?? $_SERVER['ORIG_PATH_INFO'] ?? '') !== '') { + // Do not allow trailing slashes + header('HTTP/1.1 400 Bad Request'); + die('Invalid path!'); +} + FreshRSS_Context::initUser($user); if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) { usleep(rand(100, 10000)); //Primitive mitigation of scanning for users