github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-11 10:50:35 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[PR #2578] [CLOSED] fix: use web api to extract path from URL properly #37720

New Issue
Closed
opened 2026-06-20 16:10:54 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-20 16:10:54 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2578
Author: @moohbr
Created: 3/2/2026
Status: ❌ Closed

Base: main ← Head: fix/url-path-in-apply-rules

📝 Commits (1)

  • 9c08348 fix: use web api to extract path from URL properly

📊 Changes

1 file changed (+3 additions, -2 deletions)

View changed files

📝 server/routers/badger/verifySession.ts (+3 -2)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Fix PATH based resource rules failing to match when the request contains a query string.

Badger sends the path field with the full URI including query parameters (e.g. /stream.html?token=111). The isPathAllowed function performs segment-based matching, so /stream.html?token=111 never matches a rule configured as /stream.html, causing Bypass Auth rules to silently fail for unauthenticated users.

Instead of relying on the path and host fields sent by Badger, both are now derived from originalRequestURL using the native URL API, which guarantees a clean pathname (no query string or fragment) and a consistent host.

How to test?

  1. Create a resource with Authentication = Protected and Rules enabled
  2. Add a rule: Bypass Auth → Path → /stream.html
  3. Send a request to the internal verify-session endpoint with path: /stream.html?token=111 and originalRequestURL: https://<resource-domain>/stream.html?token=111 and empty sessions
  4. Confirm the response is valid: true
  5. Send the same request with path: /config.html and confirm valid: false

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2578 **Author:** [@moohbr](https://github.com/moohbr) **Created:** 3/2/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/url-path-in-apply-rules` --- ### 📝 Commits (1) - [`9c08348`](https://github.com/fosrl/pangolin/commit/9c083480f2746c84ff339d8e914a61af458281f2) fix: use web api to extract path from URL properly ### 📊 Changes **1 file changed** (+3 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `server/routers/badger/verifySession.ts` (+3 -2) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Fix PATH based resource rules failing to match when the request contains a query string. Badger sends the path field with the full URI including query parameters (e.g. `/stream.html?token=111`). The `isPathAllowed` function performs segment-based matching, so `/stream.html?token=111` never matches a rule configured as `/stream.html`, causing `Bypass Auth` rules to silently fail for unauthenticated users. Instead of relying on the path and host fields sent by Badger, both are now derived from `originalRequestURL` using the native `URL API`, which guarantees a clean `pathname` (no query string or fragment) and a consistent host. ## How to test? 1. Create a resource with `Authentication` = Protected and Rules enabled 2. Add a rule: Bypass Auth → Path → `/stream.html` 3. Send a request to the internal verify-session endpoint with path: `/stream.html?token=111` and `originalRequestURL`: `https://<resource-domain>/stream.html?token=111` and empty sessions 4. Confirm the response is `valid: true` 5. Send the same request with path: `/config.html` and confirm `valid: false` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-20 16:10:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#37720
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?