mirror of
https://github.com/rclone/rclone.git
synced 2026-09-13 14:49:29 -04:00
Nick Craig-Wood
043e58b83c
When --cert and --key were supplied TLS was only applied to the listener if exactly one --addr was given. With two or more --addr flags every listener without an explicit tls:// prefix silently served cleartext HTTP, so adding a second --addr to an HTTPS server quietly disabled TLS on both. Now when TLS is configured every listener serves TLS. An individual listener can be prefixed with http:// to serve unencrypted HTTP on that address, and tls:// still marks a listener as TLS explicitly. Using a tls:// address without --cert and --key is now an error instead of silently serving cleartext with an https:// URL. Addresses GHSA-mfvx-7rcj-9m5g finding 3.