Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-30 18:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

strip leading slashes from path if double-slash is accidentally used, stripping trailing slash from relative path retrieved from config.json

Browse Source
This commit is contained in:
Julian Lam
2017-07-25 10:39:57 -04:00
parent 5835334b1c
commit 233297367b
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/middleware/index.js
View File

@@ -34,6 +34,15 @@ require('./maintenance')(middleware);
require('./user')(middleware);
require('./headers')(middleware);
middleware.stripLeadingSlashes = function (req, res, next) {
var target = req.originalUrl.replace(nconf.get('relative_path'), '');
if (target.startsWith('//')) {
res.redirect(nconf.get('relative_path') + target.replace(/^\/+/, '/'));
} else {
next();
}
};
middleware.pageView = function (req, res, next) {
analytics.pageView({
ip: req.ip,

2
src/routes/index.js
View File

@@ -113,6 +113,8 @@ module.exports = function (app, middleware, hotswapIds, callback) {
pluginRouter.hotswapId = 'plugins';
authRouter.hotswapId = 'auth';
app.use(middleware.stripLeadingSlashes);
app.all(relativePath + '(/api|/api/*?)', middleware.prepareAPI);
app.all(relativePath + '(/api/admin|/api/admin/*?)', middleware.isAdmin);
app.all(relativePath + '(/admin|/admin/*?)', ensureLoggedIn.ensureLoggedIn(nconf.get('relative_path') + '/login?local=1'), middleware.applyCSRF, middleware.isAdmin);

2
src/start.js
View File

@@ -93,7 +93,7 @@ function setupConfigs() {
}
// Parse out the relative_url and other goodies from the configured URL
var urlObject = url.parse(nconf.get('url'));
var relativePath = urlObject.pathname !== '/' ? urlObject.pathname : '';
var relativePath = urlObject.pathname !== '/' ? urlObject.pathname.replace(/\/+$/, '') : '';
nconf.set('base_url', urlObject.protocol + '//' + urlObject.host);
nconf.set('secure', urlObject.protocol === 'https:');
nconf.set('use_port', !!urlObject.port);