mirrors/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-03 21:00:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(httplib): prevent leaking localhost:3000 in public links (#39217)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Elisei Roca
2026-09-02 21:32:33 +02:00
committed by GitHub
parent 52fcd2d2a0
commit bcd913a4e2
9 changed files with 76 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
services/context/api.go
View File

@@ -19,6 +19,7 @@ import (
"gitea.dev/modules/cache"
"gitea.dev/modules/git"
"gitea.dev/modules/httpcache"
"gitea.dev/modules/httplib"
"gitea.dev/modules/log"
"gitea.dev/modules/paginator"
"gitea.dev/modules/reqctx"
@@ -257,8 +258,8 @@ func APIContexter() func(http.Handler) http.Handler {
Repo: &Repository{},
Org: &APIOrganization{},
}
ctx.SetContextValue(apiContextKey, ctx)
httplib.MarkRequestSupportPublicURL(ctx)
// FIXME: GLOBAL-PARSE-FORM: see more details in another FIXME comment
if ctx.Req.Method == http.MethodPost && strings.Contains(ctx.Req.Header.Get("Content-Type"), "multipart/form-data") {

3
services/context/base.go
View File

@@ -218,10 +218,9 @@ func NewBaseContext(resp http.ResponseWriter, req *http.Request) *Base {
Locale: middleware.Locale(resp, req),
Data: reqCtx.GetData(),
}
b.Req = b.Req.WithContext(b)
b.Req = httplib.RequestWithContext(b.Req, reqCtx)
reqCtx.SetContextValue(BaseContextKey, b)
reqCtx.SetContextValue(translation.ContextKey, b.Locale)
reqCtx.SetContextValue(httplib.RequestContextKey, b.Req)
return b
}

2
services/context/context.go
View File

@@ -17,6 +17,7 @@ import (
user_model "gitea.dev/models/user"
"gitea.dev/modules/cache"
"gitea.dev/modules/httpcache"
"gitea.dev/modules/httplib"
"gitea.dev/modules/reqctx"
"gitea.dev/modules/session"
"gitea.dev/modules/setting"
@@ -119,6 +120,7 @@ func NewWebContext(base *Base, render Render, session session.Store) *Context {
ctx.TemplateContext = NewTemplateContextForWeb(ctx, ctx.Base.Req, ctx.Base.Locale)
ctx.Flash = &middleware.Flash{DataStore: ctx, Values: url.Values{}}
ctx.SetContextValue(WebContextKey, ctx)
httplib.MarkRequestSupportPublicURL(ctx)
return ctx
}