kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 13:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): refuse a non-public proxy host for a key without server_proxy

Browse Source 
Closes the loopback and LAN route to the server's own forwarders, including backslash, percent-escape and *.localhost forms.
This commit is contained in:
imSp4rky
2026-11-01 20:04:06 -07:00
parent e509db618e
commit 99f0c269be
6 changed files with 120 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/configuration/services.md
+6
View File
@@ -309,6 +309,12 @@ to let that API key send a country code or a `provider:country` value, and to le
pick a proxy for the client's region and for a service geofence. The client reports its own
region; a client that reports none is not blocked.
Without `server_proxy`, the server refuses a proxy URI whose host is not a public address:
loopback, private, link-local and other special-purpose addresses, and `localhost`. This also
applies to a server on a LAN, so a client proxy on that LAN needs `server_proxy` or an admin key.
The server checks the proxy values the job uses, including a `proxy` default from the server's
own config.
```yaml
serve:
api_secret: change-me