Skip to content

Commit de37187

Browse files
committed
Make GenericWebProvider more forgiving with URLs and accept the "fixed" strings traefik provides as security measure
This fixes issue #1296
1 parent baeef12 commit de37187

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

src/Services/InfoProviderSystem/Providers/GenericWebProvider.php

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,14 @@ private function fixAndValidateURL(string $url): string
315315
//Remove any leading slashes
316316
$url = ltrim($url, '/');
317317

318-
$url = 'https://'.$url;
318+
//If the URL starts with https:/ or http:/, add the missing slash
319+
//Traefik removes the double slash as secruity measure, so we want to be forgiving and add it back if needed
320+
//See https://github.com/Part-DB/Part-DB-server/issues/1296
321+
if (preg_match('/^https?:\/[^\/]/', $url)) {
322+
$url = preg_replace('/^(https?:)\/([^\/])/', '$1//$2', $url);
323+
} else {
324+
$url = 'https://'.$url;
325+
}
319326
}
320327

321328
//If this is not a valid URL with host, domain and path, throw an exception

0 commit comments

Comments
 (0)