administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-10 08:42:49 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

pass only the request path in X-Original-URL (#24602)

Browse Source 
nginx built X-Original-URL from the client's Host header plus the request path, so a Host containing '#' or '?' pushed the real path into the URL fragment or query. The media and go2rtc auth checks then saw an empty path and allowed restricted-role users to read other cameras' clips, recordings, exports and live streams. The header now carries only $request_uri, which is all the auth checks need.
This commit is contained in:
Josh Hawkins
2026-10-09 07:44:53 -05:00
committed by GitHub
parent 2273cf2d50
commit 33cb8d987d
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/main/rootfs/usr/local/nginx/conf/proxy.conf
+1 -1
View File
@@ -2,7 +2,7 @@
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Original-URL $request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-URI $request_uri;