Commit 5b64c951 authored by Nick's avatar Nick

feat: block creating pages with system reserved paths

parent e597a7df
......@@ -2,7 +2,7 @@
# Wiki.js - CONFIGURATION #
#######################################################################
# Full documentation + examples:
# https://docs.requarks.io/wiki/install
# https://docs-beta.requarks.io/install
# ---------------------------------------------------------------------
# Port the server should listen to
......
......@@ -8,10 +8,5 @@ db:
pass: $(DB_PASS)
db: $(DB_NAME)
storage: $(DB_FILEPATH)
redis:
host: $(REDIS_HOST)
port: $(REDIS_PORT)
db: $(REDIS_DB)
password: $(REDIS_PASS)
trustProxy: $(TRUST_PROXY)
logLevel: info
......@@ -72,4 +72,14 @@ telemetry:
BUGSNAG_REMOTE: 'https://notify.bugsnag.com'
GA_ID: 'UA-9094100-7'
GA_REMOTE: 'https://www.google-analytics.com/batch'
reservedPaths:
- login
- logout
- register
- verify
- favicons
- fonts
- img
- js
- svg
# ---------------------------------
......@@ -22,6 +22,11 @@ router.get('/robots.txt', (req, res, next) => {
*/
router.get(['/e', '/e/*'], async (req, res, next) => {
const pageArgs = pageHelper.parsePath(req.path)
if (pageHelper.isReservedPath(pageArgs.path)) {
return next(new Error('Cannot create this page because it starts with a system reserved path.'))
}
let page = await WIKI.models.pages.getPageFromDb({
path: pageArgs.path,
locale: pageArgs.locale,
......
......@@ -56,5 +56,11 @@ module.exports = {
default:
return page.content
}
},
/**
* Check if path is a reserved path
*/
isReservedPath(rawPath)  {
return _.some(WIKI.data.reservedPaths, p => _.startsWith(rawPath, p))
}
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment