avm/hassio-addons
1
0
Fork 0
mirror of https://github.com/alexbelgium/hassio-addons.git synced 2026-10-21 07:20:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(wger): reject a SITE_URL with a query or fragment

Browse Source 
wger builds the app's sync endpoint as "<SITE_URL>/ps/", so a SITE_URL like
https://wger.example.com?ref=app produces https://wger.example.com?ref=app/ps/
— the /ps/ lands inside the query string and the app never reaches the route.
The glob accepted it because there is no slash after the host.

Raised by CodeRabbit on #3125, and by the Codex review before it where I
skipped it as low value; two independent reviewers and a two-line fix
changes that judgement.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
BirdNET-Go Addon Builder
2026-10-17 12:02:22 +02:00
parent 35247433f2
commit c6bcd24aae
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
wger/rootfs/etc/cont-init.d/89-powersync.sh
View File

@@ -143,6 +143,9 @@ prepare() {
refuse "SITE_URL is still the default ${SITE_URL}, which no phone can reach. Set it to the URL you open wger on." || return 1 ;;
http:// | https://) refuse "SITE_URL has no host: ${SITE_URL}" || return 1 ;;
http://*/* | https://*/*) refuse "SITE_URL must not contain a path: ${SITE_URL}" || return 1 ;;
# wger appends "/<path>/" to SITE_URL, so a query or fragment here would swallow
# the /ps/ it is meant to produce.
*\?* | *'#'*) refuse "SITE_URL must not contain a query or fragment: ${SITE_URL}" || return 1 ;;
http://* | https://*) ;;
*) refuse "SITE_URL must be an absolute http:// or https:// URL, got ${SITE_URL}" || return 1 ;;
esac