Cookie suffix calculation in the frontend is broken for script paths with more than one /

[foosel]

Problem

OctoPrint's client side getCookieSuffix is currently only replacing the first occurrence of / in the path for the R suffix component with a |. It should be replacing all.

Therefore something like /api/hassio/<token> gets turned into _P443_R|api/hassio_ingress/<token> instead of _P443_R|api|hassio_ingress|<token>.

This breaks CSRF validation in setups where OctoPrint is accessed through script paths with multiple path components.

Solution

In this line replace

return "_P" + port + "_R" + path.replace(/\//, "|");

with

return "_P" + port + "_R" + path.replace(/\//g, "|");

Additional information

As mentioned on Discord.

[foosel]

Fixed by the above commit, ready for 1.8.5.