elektrine/magpie
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: honor MAGPIE_PUBLIC_BUCKETS for unsigned media reads
All checks were successful
Deploy / Deploy over SSH (push) Successful in 1m25s
Details
CI / Test and build (push) Successful in 1m38s
Details

Browse source 
Production still set MAGPIE_PUBLIC_BUCKETS=app-uploads, but only
MAGPIE_PUBLIC_PREFIXES was read, so media.elektrine.com returned
SignatureDoesNotMatch 403. Accept bare bucket public reads and the
legacy PUBLIC_BUCKETS env.
This commit is contained in:
Maxfield Luke 2026-07-29 05:50:22 -04:00
parent aa43ce2562
commit 6a717adca2
3 changed files with 53 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

27
server_test.go
View file

@ -813,7 +813,7 @@ func TestS3PublicPrefixReadCanBeEnabled(t *testing.T) {
cfg := s3TestConfig()
cfg.AllowedBuckets = map[string]bool{"app-uploads": true}
cfg.PublicPrefixes = map[string]bool{"app-uploads/avatars": true, "app-uploads": true}
cfg.PublicPrefixes = map[string]bool{"app-uploads/avatars": true}
srv := httptest.NewServer(NewServer(store, cfg))
defer srv.Close()
@ -833,6 +833,31 @@ func TestS3PublicPrefixReadCanBeEnabled(t *testing.T) {
_ = readResponseBody(t, privateResp, http.StatusForbidden)
}
func TestS3PublicBucketReadAllowsWholeBucket(t *testing.T) {
store, err := NewFileStore(t.TempDir())
if err != nil {
t.Fatal(err)
}
if _, err := store.Put("app-uploads/static_sites/x/favicon.ico", strings.NewReader("ico"), "image/x-icon"); err != nil {
t.Fatal(err)
}
cfg := s3TestConfig()
cfg.AllowedBuckets = map[string]bool{"app-uploads": true}
cfg.PublicPrefixes = map[string]bool{"app-uploads": true}
srv := httptest.NewServer(NewServer(store, cfg))
defer srv.Close()
resp, err := http.Get(srv.URL + "/app-uploads/static_sites/x/favicon.ico")
if err != nil {
t.Fatal(err)
}
body := readResponseBody(t, resp, http.StatusOK)
if string(body) != "ico" {
t.Fatalf("public bucket GET body = %q", string(body))
}
}
func TestS3PublicReadHardensActiveContent(t *testing.T) {
store, err := NewFileStore(t.TempDir())
if err != nil {