Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block api calls to other sites - related ticket https://trello.com/c/… #341

Merged
merged 14 commits into from
Aug 22, 2022
Merged

Block api calls to other sites - related ticket https://trello.com/c/… #341

Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
4e93863
Block api calls to other sites - related ticket https://trello.com/c/…
nlsvgtr Feb 3, 2022
c2c84eb
Turn on inline authentication in participatory-budgeting-widget
nlsvgtr Mar 9, 2022
8667eaf
Add form fields
nlsvgtr Mar 9, 2022
27053c5
Use direct links to fettch iamegs in filepond
nlsvgtr Apr 11, 2022
16d8c94
Fix typo
nlsvgtr May 24, 2022
56162e5
Update node to 16.16 & run `npm update`
rudivanhierden Jul 27, 2022
045b8d2
npm audit fix
nlsvgtr Aug 8, 2022
afb003b
Merge pull request #351 from openstad/feature/update-node-16
rudivanhierden Aug 11, 2022
6cf5ecf
Merge pull request #352 from Amsterdam/codeimprovement/npm-audit-fix
nlsvgtr Aug 12, 2022
12af2be
Merge pull request #339 from Amsterdam/codeimprovement/skip-image-pro…
nlsvgtr Aug 22, 2022
aa8c321
Merge pull request #332 from Amsterdam/feature/authentication-in-part…
nlsvgtr Aug 22, 2022
360d57d
Block api calls to other sites - related ticket https://trello.com/c/…
nlsvgtr Feb 3, 2022
0ee71a3
Optional trailing slash
nlsvgtr Aug 22, 2022
6e44f61
Merge branch 'bugfix/block-api-calls-to-other-sites' of github.com:Am…
nlsvgtr Aug 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions packages/cms/lib/modules/api-proxy/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,15 @@ module.exports = {
pathRewrite: {['^' + apiPath]: '/api'},
onProxyReq: (proxyReq, req, res) => {

const siteId = req.data.global.siteId;
let path = req.path;
let match = path.match(/\/api\/site\/(\d+)\//);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be better to make the latest slash optional so it also matches this record:

/api/site/12

Regex: \/api\/site\/(\d+)\/?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. Fixed.

if (match && match[1] != siteId) {
return res.status(403).json({
'message' : self.apos.i18n.__('The api call is for another site')
});
}

/**
* Validate the request with captcha if send by a form
*/
Expand Down