mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-06 04:23:15 -05:00
Ettore Di Giacinto
0cb1490a12
StripPathPrefix and the redirect from / and /browse still read X-Forwarded-Prefix from any peer, after BaseURL and BasePathPrefix were gated on --trusted-proxies. A client could make the server strip a path prefix or add one to a redirect. Gate both on the same trusted-proxy resolver. The resolver is now stamped into the request before StripPathPrefix runs, and the check is exported as ForwardedHeadersTrusted. The explorer has no --trusted-proxies option and keeps its old behavior by trusting every peer for this one header. The docs say that the prefix needs a trusted proxy. Assisted-by: Claude:claude-sonnet-5-5 go-test
60 lines
1.5 KiB
Go
60 lines
1.5 KiB
Go
package http
|
|
|
|
import (
|
|
"io/fs"
|
|
"net/http"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
"github.com/mudler/LocalAI/core/explorer"
|
|
"github.com/mudler/LocalAI/core/http/middleware"
|
|
"github.com/mudler/LocalAI/core/http/routes"
|
|
"github.com/mudler/LocalAI/pkg/clientip"
|
|
"github.com/mudler/xlog"
|
|
)
|
|
|
|
func Explorer(db *explorer.Database) *echo.Echo {
|
|
e := echo.New()
|
|
|
|
// Set renderer
|
|
e.Renderer = renderEngine()
|
|
|
|
// Hide banner
|
|
e.HideBanner = true
|
|
|
|
// The explorer has no --trusted-proxies option. It keeps believing
|
|
// X-Forwarded-Prefix from any peer: it only strips a path prefix, and the
|
|
// explorer serves no per-user or per-host links.
|
|
anyPeer, err := clientip.Parse("0.0.0.0/0,::/0")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
e.Pre(middleware.TrustedProxies(anyPeer))
|
|
e.Pre(middleware.StripPathPrefix())
|
|
routes.RegisterExplorerRoutes(e, db)
|
|
|
|
// Favicon handler
|
|
e.GET("/favicon.svg", func(c echo.Context) error {
|
|
data, err := embedDirStatic.ReadFile("static/favicon.svg")
|
|
if err != nil {
|
|
return c.NoContent(http.StatusNotFound)
|
|
}
|
|
c.Response().Header().Set("Content-Type", "image/svg+xml")
|
|
return c.Blob(http.StatusOK, "image/svg+xml", data)
|
|
})
|
|
|
|
// Static files - use fs.Sub to create a filesystem rooted at "static"
|
|
staticFS, err := fs.Sub(embedDirStatic, "static")
|
|
if err != nil {
|
|
// Log error but continue - static files might not work
|
|
xlog.Error("failed to create static filesystem", "error", err)
|
|
} else {
|
|
e.StaticFS("/static", staticFS)
|
|
}
|
|
|
|
// Define a custom 404 handler
|
|
// Note: keep this at the bottom!
|
|
e.GET("/*", notFoundHandler)
|
|
|
|
return e
|
|
}
|