ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secret links: one mount, not two

Browse Source
This commit is contained in:
Cameron Proudlock
2026-08-21 15:23:18 -04:00
parent 627804535e
commit 1dd8474ce4
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
plugins/tools/frontend/views/SecureSendCreate.vue
View File

@@ -151,12 +151,19 @@ async function createLink() {
// withBase for the path: a site served under /shopdb or /ops carries that // withBase for the path: a site served under /shopdb or /ops carries that
// in front of every route, and leaving it off produced a 404 from IIS for a // in front of every route, and leaving it off produced a 404 from IIS for a
// secret that existed - with the sender shown a link that could never work. // secret that existed - with the sender shown a link that could never work.
const origin = (await getSiteBaseUrl()).replace(/\/+$/, '') // site_base_url is DOCUMENTED as scheme + host, but sites really do set the
const path = withBase(`/s/${token}`) // full base including the subpath - and appending the mount to one that
// already carries it produced /shopdb/shopdb/s/<token>. Tolerate both
// rather than trusting the description: add the mount only when it is not
// there already.
const configured = (await getSiteBaseUrl()).replace(/\/+$/, '')
const mount = withBase('/').replace(/\/+$/, '')
const needsMount = mount && !configured.endsWith(mount)
// The key rides in the FRAGMENT. Browsers never send it, so it reaches the // The key rides in the FRAGMENT. Browsers never send it, so it reaches the
// recipient and nowhere else. // recipient and nowhere else.
link.value = `${origin}${path}#${sealed.fragmentKey}` link.value =
`${configured}${needsMount ? mount : ''}/s/${token}#${sealed.fragmentKey}`
// Drop the plaintext as soon as it is sealed: no reason to keep it in memory // Drop the plaintext as soon as it is sealed: no reason to keep it in memory
// behind the link that replaced it. // behind the link that replaced it.
plaintext.value = '' plaintext.value = ''