9c08348 fix: use web api to extract path from URL properly
📊 Changes
1 file changed (+3 additions, -2 deletions)
View changed files
📝server/routers/badger/verifySession.ts (+3 -2)
📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
Fix PATH based resource rules failing to match when the request contains a query string.
Badger sends the path field with the full URI including query parameters (e.g. /stream.html?token=111). The isPathAllowed function performs segment-based matching, so /stream.html?token=111 never matches a rule configured as /stream.html, causing Bypass Auth rules to silently fail for unauthenticated users.
Instead of relying on the path and host fields sent by Badger, both are now derived from originalRequestURL using the native URL API, which guarantees a clean pathname (no query string or fragment) and a consistent host.
How to test?
Create a resource with Authentication = Protected and Rules enabled
Add a rule: Bypass Auth → Path → /stream.html
Send a request to the internal verify-session endpoint with path: /stream.html?token=111 and originalRequestURL: https://<resource-domain>/stream.html?token=111 and empty sessions
Confirm the response is valid: true
Send the same request with path: /config.html and confirm valid: false
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2578
**Author:** [@moohbr](https://github.com/moohbr)
**Created:** 3/2/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/url-path-in-apply-rules`
---
### 📝 Commits (1)
- [`9c08348`](https://github.com/fosrl/pangolin/commit/9c083480f2746c84ff339d8e914a61af458281f2) fix: use web api to extract path from URL properly
### 📊 Changes
**1 file changed** (+3 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `server/routers/badger/verifySession.ts` (+3 -2)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description
Fix PATH based resource rules failing to match when the request contains a query string.
Badger sends the path field with the full URI including query parameters (e.g. `/stream.html?token=111`). The `isPathAllowed` function performs segment-based matching, so `/stream.html?token=111` never matches a rule configured as `/stream.html`, causing `Bypass Auth` rules to silently fail for unauthenticated users.
Instead of relying on the path and host fields sent by Badger, both are now derived from `originalRequestURL` using the native `URL API`, which guarantees a clean `pathname` (no query string or fragment) and a consistent host.
## How to test?
1. Create a resource with `Authentication` = Protected and Rules enabled
2. Add a rule: Bypass Auth → Path → `/stream.html`
3. Send a request to the internal verify-session endpoint with path: `/stream.html?token=111` and `originalRequestURL`: `https://<resource-domain>/stream.html?token=111` and empty sessions
4. Confirm the response is `valid: true`
5. Send the same request with path: `/config.html` and confirm `valid: false`
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2578
Author: @moohbr
Created: 3/2/2026
Status: ❌ Closed
Base:
main← Head:fix/url-path-in-apply-rules📝 Commits (1)
9c08348fix: use web api to extract path from URL properly📊 Changes
1 file changed (+3 additions, -2 deletions)
View changed files
📝
server/routers/badger/verifySession.ts(+3 -2)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description
Fix PATH based resource rules failing to match when the request contains a query string.
Badger sends the path field with the full URI including query parameters (e.g.
/stream.html?token=111). TheisPathAllowedfunction performs segment-based matching, so/stream.html?token=111never matches a rule configured as/stream.html, causingBypass Authrules to silently fail for unauthenticated users.Instead of relying on the path and host fields sent by Badger, both are now derived from
originalRequestURLusing the nativeURL API, which guarantees a cleanpathname(no query string or fragment) and a consistent host.How to test?
Authentication= Protected and Rules enabled/stream.html/stream.html?token=111andoriginalRequestURL:https://<resource-domain>/stream.html?token=111and empty sessionsvalid: true/config.htmland confirmvalid: false🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.