From c6bcd24aae65305902687e4f4b00d82f15f9eb8b Mon Sep 17 00:00:00 2001 From: BirdNET-Go Addon Builder Date: Sat, 17 Oct 2026 12:02:22 +0200 Subject: [PATCH] fix(wger): reject a SITE_URL with a query or fragment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wger builds the app's sync endpoint as "/ps/", so a SITE_URL like https://wger.example.com?ref=app produces https://wger.example.com?ref=app/ps/ — the /ps/ lands inside the query string and the app never reaches the route. The glob accepted it because there is no slash after the host. Raised by CodeRabbit on #3125, and by the Codex review before it where I skipped it as low value; two independent reviewers and a two-line fix changes that judgement. Co-Authored-By: Claude Opus 5 --- wger/rootfs/etc/cont-init.d/89-powersync.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/wger/rootfs/etc/cont-init.d/89-powersync.sh b/wger/rootfs/etc/cont-init.d/89-powersync.sh index 41d6dd160c..ac8790f140 100644 --- a/wger/rootfs/etc/cont-init.d/89-powersync.sh +++ b/wger/rootfs/etc/cont-init.d/89-powersync.sh @@ -143,6 +143,9 @@ prepare() { refuse "SITE_URL is still the default ${SITE_URL}, which no phone can reach. Set it to the URL you open wger on." || return 1 ;; http:// | https://) refuse "SITE_URL has no host: ${SITE_URL}" || return 1 ;; http://*/* | https://*/*) refuse "SITE_URL must not contain a path: ${SITE_URL}" || return 1 ;; + # wger appends "//" to SITE_URL, so a query or fragment here would swallow + # the /ps/ it is meant to produce. + *\?* | *'#'*) refuse "SITE_URL must not contain a query or fragment: ${SITE_URL}" || return 1 ;; http://* | https://*) ;; *) refuse "SITE_URL must be an absolute http:// or https:// URL, got ${SITE_URL}" || return 1 ;; esac