mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2026-08-07 07:14:49 +00:00
Erik Michelson
6c5b44eaec
Previously, the permission checks of the /media/:uuid route could be bypassed for the local filesystem as a media backend, because the /media/:uuid route performed a redirect to the target after checking the permissions. Since the target was always /uploads/:uuid.ext where ext was the extension of the uploaded file, you could simply try to guess the file extension and have access to the file since the /uploads endpoint was simply the complete uploads folder mounted. Now, media uploads from the local filesystem backend are served under the /media route directly instead of a redirect. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
31 lines
963 B
Caddyfile
31 lines
963 B
Caddyfile
#
|
|
# SPDX-FileCopyrightText: 2024 The HedgeDoc developers (see AUTHORS file)
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
#
|
|
|
|
# Allow private ranges as proxies, for example when running Caddy behind another reverse proxy
|
|
# Otherwise Caddy strips the required X-Forwarded-Proto and X-Forwarded-Host headers
|
|
# This is a common scenario when exposing a local dev setup to someone else
|
|
{
|
|
servers {
|
|
trusted_proxies static private_ranges
|
|
}
|
|
}
|
|
|
|
# Use port 8080 by default, but allow overriding using CADDY_HOST env variable
|
|
{$CADDY_HOST::8080} {
|
|
|
|
log {
|
|
output stdout
|
|
level WARN
|
|
format console
|
|
}
|
|
|
|
reverse_proxy /realtime http://localhost:{$HD_BACKEND_PORT:3000}
|
|
reverse_proxy /api/* http://localhost:{$HD_BACKEND_PORT:3000}
|
|
reverse_proxy /public/* http://localhost:{$HD_BACKEND_PORT:3000}
|
|
reverse_proxy /media/* http://localhost:{$HD_BACKEND_PORT:3000}
|
|
reverse_proxy /* http://localhost:{$HD_FRONTEND_PORT:3001}
|
|
}
|