Backups/mihomo
1
0
Fork 0
mirror of https://github.com/MetaCubeX/mihomo.git synced 2025-01-07 09:53:58 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix: API auth bypass

Browse Source
This commit is contained in:
Dreamacro 2020-04-24 23:49:35 +08:00
parent 3fc6d55003
commit 2b33bfae6b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hub/route/server.go
View File

@ -110,9 +110,9 @@ func authentication(next http.Handler) http.Handler {
header := r.Header.Get("Authorization") header := r.Header.Get("Authorization")
text := strings.SplitN(header, " ", 2) text := strings.SplitN(header, " ", 2)
hasUnvalidHeader := text[0] != "Bearer" hasInvalidHeader := text[0] != "Bearer"
hasUnvalidSecret := len(text) == 2 && text[1] != serverSecret hasInvalidSecret := len(text) != 2 || text[1] != serverSecret
if hasUnvalidHeader || hasUnvalidSecret { if hasInvalidHeader || hasInvalidSecret {
render.Status(r, http.StatusUnauthorized) render.Status(r, http.StatusUnauthorized)
render.JSON(w, r, ErrUnauthorized) render.JSON(w, r, ErrUnauthorized)
return return