Fabio/nginx-proxy-manager
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Fix IP access list control regression

Browse source 
IP access list control was implemented as default success for an
empty access control list - but this had the effect of an empty list
default allowing if "Satisfy Any" was set.

Fortunately this was bugged, so empty lists default failed - but this
broke empty lists for "Satisfy All".

This patch is the correct fix: lists now always default fail, but an
empty list removes the check from access control considerations.

This restores the original implementations behavior and fixes the bug.
This commit is contained in:
Will Rouesnel 2023-08-31 15:36:53 +10:00
parent 0969cd76be
commit aca8206c30
No known key found for this signature in database
GPG key ID: 72DC65802A1091C5
2 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
backend/templates/_access.conf
View file

@ -2,17 +2,24 @@
set $auth_basic "Authorization required"; set $auth_basic "Authorization required";
{% if access_list.satisfy_any == 1 %} {% if access_list.satisfy_any == 1 %}
# Satisfy Any - any check can succeed - so look for success # Satisfy Any - any check can succeed - so look for success
{% if access_list.clients.size != 0 %}
if ( $access_list_{{ access_list_id }} = 1) { if ( $access_list_{{ access_list_id }} = 1) {
set $auth_basic off; set $auth_basic off;
} }
{% endif %}
if ( $ssl_client_verify = "SUCCESS" ) { if ( $ssl_client_verify = "SUCCESS" ) {
set $auth_basic off; set $auth_basic off;
} }
{% else %} {% else %}
# Satisfy All - all checks must succeed (so handle fails) # Satisfy All - all checks must succeed (so handle fails)
{% if access_list.clients.size != 0 %}
# {{ access_list.clients.size }} IP rules
if ( $access_list_{{ access_list_id }} = 0) { if ( $access_list_{{ access_list_id }} = 0) {
return {% if drop_unauthorized == 1 %}444{% else %}403{% endif %}; return {% if drop_unauthorized == 1 %}444{% else %}403{% endif %};
} }
{% else %}
# Empty IP rules list so no client IP check
{% endif %}
if ( $ssl_client_verify != "SUCCESS" ) { if ( $ssl_client_verify != "SUCCESS" ) {
return {% if drop_unauthorized == 1 %}444{% else %}403{% endif %}; return {% if drop_unauthorized == 1 %}444{% else %}403{% endif %};
} }

4
backend/templates/access.conf
View file

@ -1,10 +1,6 @@
# Access List Clients for {{ access_list.id }} - {{ access_list.name }} # Access List Clients for {{ access_list.id }} - {{ access_list.name }}
geo $realip_remote_addr $access_list_{{ access_list.id }} { geo $realip_remote_addr $access_list_{{ access_list.id }} {
{% if access_list.client.size == 0 %}
default 1;
{% else %}
default 0; default 0;
{% endif %}
{% for client in access_list.clients %} {% for client in access_list.clients %}
{% if client.directive == "allow" %} {% if client.directive == "allow" %}
{{client.address}} 1; {{client.address}} 1;