public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Commit
[Web] use SEC_FETCH_DEST header to block api requests
cd24057f
data/web/json_api.php | 6 ++++++
1 file changed, 6 insertions(+)Diff
diff --git a/data/web/json_api.php b/data/web/json_api.php
index 079e79ce..2458e662 100644
--- a/data/web/json_api.php
+++ b/data/web/json_api.php
@@ -47,6 +47,12 @@ function api_log($_data) {
}
}
+// Block requests not intended for direct API use by checking the 'Sec-Fetch-Dest' header.
+if (isset($_SERVER['HTTP_SEC_FETCH_DEST']) && $_SERVER['HTTP_SEC_FETCH_DEST'] !== 'empty') {
+ header('HTTP/1.1 403 Forbidden');
+ exit;
+}
+
if (isset($_GET['query'])) {
$query = explode('/', $_GET['query']);