dominik/homepage-plus
1
0
Fork 0
mirror of https://github.com/DI0IK/homepage-plus.git synced 2025-07-19 02:59:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request from GHSA-24m5-7vjx-9x37

Browse source 
* Restrict emby endpoints and proxy segments

* Dont allow path traversal in segments

* Restrict qbittorrent proxy endpoints

* Restrict npm proxy endpoints

* Restrict flood proxy endpoints

* Restrict tdarr proxy endpoints

* Restrict xteve proxy endpoints

* Restrict transmission proxy endpoints

* disallow non-mapped endpoints

this change drops all requests that have un-mapped endpoint queries

allowedEndpoints is added as a method to pass proxy requests via a regex on the endpoint

most widgets with custom proxies use either no endpoint, or a static one

Co-Authored-By: Ben Phelps <ben@phelps.io>
This commit is contained in:
shamoon 2024-06-02 20:11:03 -07:00
parent 8823b04291
commit b3cf985d4a
22 changed files with 78 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/widgets/npm/component.jsx
View file

@ -5,7 +5,7 @@ import useWidgetAPI from "utils/proxy/use-widget-api";
export default function Component({ service }) {
const { widget } = service;
const { data: infoData, error: infoError } = useWidgetAPI(widget, "nginx/proxy-hosts");
const { data: infoData, error: infoError } = useWidgetAPI(widget, "hosts");
if (infoError) {
return <Container service={service} error={infoError} />;

6
src/widgets/npm/widget.js
View file

@ -3,6 +3,12 @@ import npmProxyHandler from "./proxy";
const widget = {
api: "{url}/api/{endpoint}",
proxyHandler: npmProxyHandler,
mappings: {
hosts: {
endpoint: "nginx/proxy-hosts",
},
},
};
export default widget;