sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

DC-044: fix slice(13) -> slice(12) for /api/v1/auth/totp/check-session drift
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source 
Slice(13) was off by one — it dropped the leading '/' before 'totp/'
producing /api/v1totp/check-session. Should be slice(12) so the '/'
stays.
This commit is contained in:
Krystie
2026-07-08 21:43:12 -07:00
parent 1baef432c4
commit 2169ec9853
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/src/app.js
+2 -2
View File
@@ -220,8 +220,8 @@ async function createApp() {
req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9 req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
} else if (req.url.startsWith('/api/v1/auth/totp/check-session')) { } else if (req.url.startsWith('/api/v1/auth/totp/check-session')) {
// Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session // Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session
// Drop the '/api/v1' prefix AND the '/auth' middle segment (13 chars total). // Drop the '/api/v1/auth' prefix (12 chars), keep the leading '/'.
req.url = '/api/v1' + req.url.slice(13); // '/api/v1/auth'.length === 13 req.url = '/api/v1' + req.url.slice(12); // '/api/v1/auth'.length === 12
} }
next(); next();
}); });