copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #216 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-access

Browse Source 
Disable global .pdf shortcut to prevent unauthenticated certificate downloads
This commit is contained in:
Jeppe B
2026-06-01 23:09:03 +02:00
committed by GitHub
parent 7bb67b0470 2a1a730a8c
commit 8f53e80ede
1 changed files with 0 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/index.php
-5
View File
@@ -237,11 +237,6 @@ if (php_sapi_name() === 'cli' || isset($_GET['internalCronCall'])) {
exit;
}
// If the route ends with .php, then require the file_server.php
if (str_contains($_SERVER['REQUEST_URI'], '.pdf')) {
require_once 'file_server.php';
exit;
}
// If the route ends with a MIME type, then require the file_server.php
if ((preg_match('/\.(jpg|jpeg|png)$/', $_SERVER['REQUEST_URI']) || str_contains($_SERVER['REQUEST_URI'], '/files/'))) {
require_once 'file_server.php';