Browse Source

fix: admin security UI

pull/1975/head
NGPixel 5 years ago
parent
commit
83f7c2867d
2 changed files with 3 additions and 2 deletions
  1. 3
      client/components/admin/admin-security.vue
  2. 2
      server/middlewares/security.js

3
client/components/admin/admin-security.vue

@ -20,7 +20,7 @@
v-card-info(color='red')
span Make sure to understand the implications before turning on / off a security feature.
v-card-text
v-switch.mt-3(
v-switch(
inset
label='Block Open Redirect'
color='red darken-2'
@ -29,6 +29,7 @@
hint='Prevents user controlled URLs from directing to websites outside of your wiki. This provides Open Redirect protection.'
)
v-divider.mt-3
v-switch.mt-3(
inset
label='Block IFrame Embedding'

2
server/middlewares/security.js

@ -39,7 +39,7 @@ module.exports = function (req, res, next) {
// -> Prevent Open Redirect from user provided URL
if (WIKI.config.security.securityOpenRedirect) {
// Strips out all repeating / character in the provided URL
req.url = req.url.replace(/(\/)(?=\/*\1)/g, "")
req.url = req.url.replace(/(\/)(?=\/*\1)/g, '')
}
return next()

Loading…
Cancel
Save