elektrine/magpie
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: honor MAGPIE_PUBLIC_BUCKETS for unsigned media reads
All checks were successful
Deploy / Deploy over SSH (push) Successful in 1m25s
Details
CI / Test and build (push) Successful in 1m38s
Details

Browse source 
Production still set MAGPIE_PUBLIC_BUCKETS=app-uploads, but only
MAGPIE_PUBLIC_PREFIXES was read, so media.elektrine.com returned
SignatureDoesNotMatch 403. Accept bare bucket public reads and the
legacy PUBLIC_BUCKETS env.
This commit is contained in:
Maxfield Luke 2026-07-29 05:50:22 -04:00
parent aa43ce2562
commit 6a717adca2
3 changed files with 53 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

9
server.go
View file

@ -334,8 +334,15 @@ func (s *Server) bucketAllowed(bucket string) bool {
func (s *Server) publicReadAllowed(key string) bool {
for prefix := range s.cfg.PublicPrefixes {
prefix = strings.TrimSuffix(prefix, "/")
prefix = strings.Trim(prefix, "/")
if prefix == "" {
continue
}
// Bare bucket name: allow any key under that bucket.
if !strings.Contains(prefix, "/") {
if key == prefix || strings.HasPrefix(key, prefix+"/") {
return true
}
continue
}
if key == prefix || strings.HasPrefix(key, prefix+"/") {