mirror of
https://github.com/blakeblackshear/frigate.git
synced 2026-08-05 18:38:54 +03:00
Josh Hawkins
3b87df2485
/auth grants anonymous admin to any request whose X-Server-Port matches networking.listen.internal, but it read that port off the live config while nginx binds its listeners once at container start and never reloads them, so any path that swaps the running config could move the trusted port without nginx moving with it. Saving networking.listen.internal equal to the external port applied immediately despite the restart-required warning, which handed unauthenticated admin to everything reaching the external port. Snapshot the port at app creation and compare against that instead, and reject a config whose two listeners share a port number, which nginx would refuse to start with anyway.
63 lines
1.9 KiB
Python
63 lines
1.9 KiB
Python
from pydantic import Field, model_validator
|
|
|
|
from .base import FrigateBaseModel
|
|
|
|
__all__ = ["IPv6Config", "ListenConfig", "NetworkingConfig"]
|
|
|
|
|
|
def parse_listen_port(value: int | str) -> int:
|
|
"""Return the port number from a bare port or an "address:port" value."""
|
|
if isinstance(value, str):
|
|
return int(value.split(":")[-1])
|
|
|
|
return value
|
|
|
|
|
|
class IPv6Config(FrigateBaseModel):
|
|
enabled: bool = Field(
|
|
default=False,
|
|
title="Enable IPv6",
|
|
description="Enable IPv6 support for Frigate services (API and UI) where applicable.",
|
|
)
|
|
|
|
|
|
class ListenConfig(FrigateBaseModel):
|
|
internal: int | str = Field(
|
|
default=5000,
|
|
title="Internal port",
|
|
description="Internal listening port for Frigate (default 5000).",
|
|
)
|
|
external: int | str = Field(
|
|
default=8971,
|
|
title="External port",
|
|
description="External listening port for Frigate (default 8971).",
|
|
)
|
|
|
|
@property
|
|
def internal_port(self) -> int:
|
|
return parse_listen_port(self.internal)
|
|
|
|
@property
|
|
def external_port(self) -> int:
|
|
return parse_listen_port(self.external)
|
|
|
|
@model_validator(mode="after")
|
|
def validate_distinct_ports(self) -> "ListenConfig":
|
|
if self.internal_port == self.external_port:
|
|
raise ValueError("internal and external must listen on different ports")
|
|
|
|
return self
|
|
|
|
|
|
class NetworkingConfig(FrigateBaseModel):
|
|
ipv6: IPv6Config = Field(
|
|
default_factory=IPv6Config,
|
|
title="IPv6 configuration",
|
|
description="IPv6-specific settings for Frigate network services.",
|
|
)
|
|
listen: ListenConfig = Field(
|
|
default_factory=ListenConfig,
|
|
title="Listening ports configuration",
|
|
description="Configuration for internal and external listening ports. This is for advanced users. For the majority of use cases it's recommended to change the ports section of your Docker compose file.",
|
|
)
|