try to detect some proxy configuration to avoid unwanted admin access
Massimo Melina committed
Apr 2, 2022 at 11:00 UTC
d86448ec6ea506eb5319d8422a8ca0a7ec510bdb
1 file changed
+2
-1
server/src/adminApis.ts
+2
-1
@@ -122,5 +122,6 @@ for (const k in adminApis) {
122
}
123
124
export function ctxAdminAccess(ctx: Koa.Context) {
125
- return isLocalHost(ctx) || getFromAccount(ctx.state.account, a => a.admin)
125
+ return isLocalHost(ctx) && !ctx.get('X-Forwarded-For') // this may detect an http-proxied request on localhost
126
+ || getFromAccount(ctx.state.account, a => a.admin)
127
}