Leahnaya/website
1
0
Fork 0
mirror of https://github.com/PretendoNetwork/website.git synced 2026-03-21 17:24:28 -05:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix: fix redirection for external sites #294

Browse Source
This commit is contained in:
William Oldham 2025-01-20 16:46:37 +00:00
parent 973d50006c
commit 5facdcdd83
2 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/config.js
View File

@ -17,7 +17,8 @@ module.exports = {
api_base: jsonConfig.api_base,
http: {
base_url: jsonConfig.http.base_url,
port: jsonConfig.http.port
port: jsonConfig.http.port,
allowed_redirection_suffixes: Array.isArray(jsonConfig.http.allowed_redirection_suffixes) ? jsonConfig.http.allowed_redirection_suffixes : ['pretendo.network']
},
github: {
graphql_token: jsonConfig.github.graphql_token

23
src/middleware/redirect.js
View File

@ -1,14 +1,31 @@
const config = require('../config');
function isValidRedirect(redirect) {
if (!redirect) return false;
if (redirect.startsWith('/')) return true;
if (redirect.startsWith('http://') || redirect.startsWith('https://')) {
try {
const url = new URL(redirect);
return config.http.valid_redirection_domains.some(domain => url.hostname.endsWith(domain));
} catch (ignored) {
return false;
}
}
return false;
}
async function redirectMiddleware(request, response, next) {
if (request.path.startsWith('/account/logout')) {
return next();
}
if (request.method === 'POST') {
request.redirect = request.body.redirect?.startsWith('/') ? request.body.redirect : null;
if (request.method === 'POST' && request.body) {
request.redirect = isValidRedirect(request.body.redirect) ? request.body.redirect : null;
}
if (request.query.redirect) {
response.locals.redirect = request.query.redirect?.startsWith('/') ? request.query.redirect : null;
response.locals.redirect = isValidRedirect(request.query.redirect) ? request.query.redirect : null;
}
return next();