kosmos/mastodon
kosmos/mastodon
8
0
Fork 0
Code Pull Requests Activity

Fix guard against DNS rebinding attacks (#16095)

Browse Source
This commit is contained in:
Takeshi Umeda 2021-04-23 03:33:36 +09:00 committed by GitHub
parent 2eb17360df
commit 2360191434
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/initializers/1_hosts.rb
View File

@ -4,7 +4,7 @@ port = ENV.fetch('PORT') { 3000 }
host = ENV.fetch('LOCAL_DOMAIN') { "localhost:#{port}" } host = ENV.fetch('LOCAL_DOMAIN') { "localhost:#{port}" }
web_host = ENV.fetch('WEB_DOMAIN') { host } web_host = ENV.fetch('WEB_DOMAIN') { host }
alternate_domains = ENV.fetch('ALTERNATE_DOMAINS') { '' } alternate_domains = ENV.fetch('ALTERNATE_DOMAINS') { '' }.split(/\s*,\s*/)
Rails.application.configure do Rails.application.configure do
https = Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true' https = Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'
@ -15,7 +15,7 @@ Rails.application.configure do
config.x.use_s3 = ENV['S3_ENABLED'] == 'true' config.x.use_s3 = ENV['S3_ENABLED'] == 'true'
config.x.use_swift = ENV['SWIFT_ENABLED'] == 'true' config.x.use_swift = ENV['SWIFT_ENABLED'] == 'true'
config.x.alternate_domains = alternate_domains.split(/\s*,\s*/) config.x.alternate_domains = alternate_domains
config.action_mailer.default_url_options = { host: web_host, protocol: https ? 'https://' : 'http://', trailing_slash: false } config.action_mailer.default_url_options = { host: web_host, protocol: https ? 'https://' : 'http://', trailing_slash: false }
@ -30,6 +30,6 @@ Rails.application.configure do
unless Rails.env.test? unless Rails.env.test?
config.hosts << host if host.present? config.hosts << host if host.present?
config.hosts << web_host if web_host.present? config.hosts << web_host if web_host.present?
config.hosts << alternate_domains if alternate_domains.present? config.hosts.concat(alternate_domains) if alternate_domains.present?
end end
end end