From 3b10fd9b3452d548ef116b27161b17f57a8e180c Mon Sep 17 00:00:00 2001 From: wxiaoguang Date: Fri, 20 Sep 2024 22:57:55 +0800 Subject: [PATCH 1/3] Only use Host header from reverse proxy (#32060) X-Forwarded-Host has many problems: non-standard, not well-defined (X-Forwarded-Port or not), conflicts with Host header, it already caused problems like #31907. So do not use X-Forwarded-Host, just use Host header directly. Official document also only uses `Host` header and never mentioned others. --- .github/workflows/pull-db-tests.yml | 3 ++- modules/httplib/url.go | 13 +++---------- modules/httplib/url_test.go | 5 +++-- 3 files changed, 8 insertions(+), 13 deletions(-) diff --git a/.github/workflows/pull-db-tests.yml b/.github/workflows/pull-db-tests.yml index 246884f24b..90804c0f0a 100644 --- a/.github/workflows/pull-db-tests.yml +++ b/.github/workflows/pull-db-tests.yml @@ -201,7 +201,8 @@ jobs: runs-on: ubuntu-latest services: mssql: - image: mcr.microsoft.com/mssql/server:2017-latest + # some images before 2024-04 can't run on new kernels + image: mcr.microsoft.com/mssql/server:2019-latest env: ACCEPT_EULA: Y MSSQL_PID: Standard diff --git a/modules/httplib/url.go b/modules/httplib/url.go index 219dfe695c..e3bad1e5fb 100644 --- a/modules/httplib/url.go +++ b/modules/httplib/url.go @@ -52,11 +52,6 @@ func getRequestScheme(req *http.Request) string { return "" } -func getForwardedHost(req *http.Request) string { - // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host - return req.Header.Get("X-Forwarded-Host") -} - // GuessCurrentAppURL tries to guess the current full app URL (with sub-path) by http headers. It always has a '/' suffix, exactly the same as setting.AppURL func GuessCurrentAppURL(ctx context.Context) string { return GuessCurrentHostURL(ctx) + setting.AppSubURL + "/" @@ -81,11 +76,9 @@ func GuessCurrentHostURL(ctx context.Context) string { if reqScheme == "" { return strings.TrimSuffix(setting.AppURL, setting.AppSubURL+"/") } - reqHost := getForwardedHost(req) - if reqHost == "" { - reqHost = req.Host - } - return reqScheme + "://" + reqHost + // X-Forwarded-Host has many problems: non-standard, not well-defined (X-Forwarded-Port or not), conflicts with Host header. + // So do not use X-Forwarded-Host, just use Host header directly. + return reqScheme + "://" + req.Host } // MakeAbsoluteURL tries to make a link to an absolute URL: diff --git a/modules/httplib/url_test.go b/modules/httplib/url_test.go index 28aaee6e12..fc6c91cd3a 100644 --- a/modules/httplib/url_test.go +++ b/modules/httplib/url_test.go @@ -70,7 +70,7 @@ func TestMakeAbsoluteURL(t *testing.T) { "X-Forwarded-Proto": {"https"}, }, }) - assert.Equal(t, "https://forwarded-host/foo", MakeAbsoluteURL(ctx, "/foo")) + assert.Equal(t, "https://user-host/foo", MakeAbsoluteURL(ctx, "/foo")) } func TestIsCurrentGiteaSiteURL(t *testing.T) { @@ -119,5 +119,6 @@ func TestIsCurrentGiteaSiteURL(t *testing.T) { }, }) assert.True(t, IsCurrentGiteaSiteURL(ctx, "http://localhost:3000")) - assert.True(t, IsCurrentGiteaSiteURL(ctx, "https://forwarded-host")) + assert.True(t, IsCurrentGiteaSiteURL(ctx, "https://user-host")) + assert.False(t, IsCurrentGiteaSiteURL(ctx, "https://forwarded-host")) } From aa9faf825074110d31fc2c75a31880c98a48feb2 Mon Sep 17 00:00:00 2001 From: silverwind Date: Fri, 20 Sep 2024 17:27:19 +0200 Subject: [PATCH 2/3] Set manual `tabindex`es on login page (#31689) Fixes https://github.com/go-gitea/gitea/issues/31686. A more elborate manual tabindex numbering could be done, but I think it's not really worth the extra effort and such stuff could easily break during refactors. Includes another small tweak to un-stretch the`` element so it's only as large as it needs to be and this change also made the margin unneeded. --- templates/user/auth/signin_inner.tmpl | 12 +++++++----- web_src/css/form.css | 1 - 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/templates/user/auth/signin_inner.tmpl b/templates/user/auth/signin_inner.tmpl index b0a52d2c64..ec61e56f4d 100644 --- a/templates/user/auth/signin_inner.tmpl +++ b/templates/user/auth/signin_inner.tmpl @@ -14,20 +14,22 @@ {{.CsrfTokenHtml}}
- +
{{if or (not .DisablePassword) .LinkAccountMode}}
- {{ctx.Locale.Tr "auth.forgot_password"}} - +
+ {{ctx.Locale.Tr "auth.forgot_password"}} +
+
{{end}} {{if not .LinkAccountMode}}
- +
{{end}} @@ -35,7 +37,7 @@ {{template "user/auth/captcha" .}}
-