From 03113745d191afa8a6c729b6da24033f53f3e328 Mon Sep 17 00:00:00 2001 From: ljf Date: Sat, 14 Sep 2019 19:58:58 +0200 Subject: [PATCH] [fix] Avoid remote unencrypted destination in proxy mode --- scripts/install | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scripts/install b/scripts/install index dc53e28..a663b8d 100644 --- a/scripts/install +++ b/scripts/install @@ -53,6 +53,12 @@ url_regex='(https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%= [[ ! $redirect_path =~ $url_regex ]] && ynh_die \ "Invalid destination: $redirect_path" 1 +# Avoid uncrypted remote destination with reverse proxy mode +# Indeed the SSO send the password in all requests in HTTP headers +url_regex='(http://(127.\d+.\d+.\d+|localhost)(:\d+)?/|https://)[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]' +[[ "$redirect_type" = "proxy" ]] && [[ ! $redirect_path =~ $url_regex ]] && ynh_die \ +"For secure reason, you can't use an unencrypted http remote destination couple with ssowat for your reverse proxy: $redirect_path" 1 + # Save extra settings yunohost app setting $app is_public -v "$is_public" yunohost app setting $app redirect_type -v "$redirect_type"