From a890665775910143c39bc044714141b3853d1e0a Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Sat, 9 Oct 2021 13:33:01 +0200 Subject: [PATCH] Allow revealing server field with ?server --- components/app.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/components/app.js b/components/app.js index b5f7f66..d254250 100644 --- a/components/app.js +++ b/components/app.js @@ -220,7 +220,11 @@ export default class App extends Component { } let queryParams = parseQueryString(); - if (typeof queryParams.server === "string" && !connectParams.url) { + // Don't allow to silently override the server URL if there's one in + // config.json, because this has security implications. But still allow + // setting server to an empty string to reveal the server field in the + // connect form. + if (typeof queryParams.server === "string" && (!connectParams.url || !queryParams.server)) { connectParams.url = queryParams.server; // When using a custom server, some configuration options don't