recaptime.dev / phorge
@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.) hq.recaptime.dev/wiki/Phorge
phorge phabricator
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Allow only CDN routes when using security.alternate-file-domain

Summary:
Instead of allowing all routes based on security.alternate-file-domain, now, when security.alternate-file-domain is set, and the request matches this domain, requests are validated against an explicit list. Allowed routes:
- /res/
- /file/data/
- /file/xform/
- /phame/r/

This will be redone by T5702 to be less of a hack.

Test Plan:
- browse around (incl. Phame live) to make sure there is no regression from this when security.alternate-file-domain is not used.
- check that celerity resources and files (incl. previews) are served with security.alternate-file-domain set.
- check that phame live blog is serving its css correctly with security.alternate-file-domain set.
- check that requests outside of the whitelist generate an exception for security.alternate-file-domain

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D10048

authored by

Joseph Battelle and committed by
epriestley c006cca9 51b5bf1e

+18 -1
+18 -1
src/aphront/configuration/AphrontApplicationConfiguration.php
··· 113 113 array( 114 114 $base_uri, 115 115 $prod_uri, 116 - $file_uri, 117 116 ), 118 117 $conduit_uris, 119 118 $allowed_uris); 120 119 120 + $cdn_routes = array( 121 + '/res/', 122 + '/file/data/', 123 + '/file/xform/', 124 + '/phame/r/', 125 + ); 126 + 121 127 $host_match = false; 122 128 foreach ($uris as $uri) { 123 129 if ($host === id(new PhutilURI($uri))->getDomain()) { 124 130 $host_match = true; 125 131 break; 132 + } 133 + } 134 + 135 + if (!$host_match) { 136 + if ($host === id(new PhutilURI($file_uri))->getDomain()) { 137 + foreach ($cdn_routes as $route) { 138 + if (strncmp($path, $route, strlen($route)) == 0) { 139 + $host_match = true; 140 + break; 141 + } 142 + } 126 143 } 127 144 } 128 145