CERBERUS/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2026-08-04 14:58:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

admin: fix empty allowedPath regression and dead code in path normalization

Browse source 
path.Clean("") returns ".", so cleaning allowedPath unconditionally
silently broke the allow-all behavior when Paths: [""] is configured.
Short-circuit the empty case before cleaning to preserve that behavior.

Also remove the dead strings.HasSuffix(allowedPath, "/") branch —
after path.Clean the path never has a trailing slash, so the unified
reqPath == allowedPath || HasPrefix(reqPath, allowedPath+"/") form
covers exact match, subpath boundary, and trailing-slash requests.

Co-authored-by: atlarix-agent <agent@atlarix.dev>
Co-authored-by: iabdullah215 <muhammadabdullah8040@gmail.com>
This commit is contained in:
Amariah Kamau 2026-07-28 11:46:25 +03:00
parent 8a0651ad13
commit 7340171f99
1 changed files with 5 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
admin.go
View file

@ -724,18 +724,14 @@ func (remote RemoteAdmin) enforceAccessControls(r *http.Request) error {
func adminPathAllowed(reqPath, allowedPath string) bool {
reqPath = path.Clean(reqPath)
allowedPath = path.Clean(allowedPath)
if allowedPath == "" || allowedPath == "/" {
return strings.HasPrefix(reqPath, allowedPath)
}
if reqPath == allowedPath {
if allowedPath == "" {
return true
}
if strings.HasSuffix(allowedPath, "/") {
return strings.HasPrefix(reqPath, allowedPath)
allowedPath = path.Clean(allowedPath)
if allowedPath == "/" {
return true
}
return strings.HasPrefix(reqPath, allowedPath+"/")
return reqPath == allowedPath || strings.HasPrefix(reqPath, allowedPath+"/")
}
func stopAdminServer(srv *http.Server) error {