Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-10-26 23:18:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent Host header injection attacks

Browse Source
This commit is contained in:
Athou
2026-08-17 22:18:59 +02:00
parent f3c390e0e0
commit 7f77cf0268
5 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
View File

@@ -413,7 +413,8 @@ public class UserREST {
}
private String buildEmailContent(User user) throws URISyntaxException {
String publicUrl = Urls.removeTrailingSlash(uri.getBaseUri().toString());
String publicUrl =
Urls.removeTrailingSlash(config.passwordRecoveryPublicBaseUrl().orElseThrow());
return String.format(
"You asked for password recovery for account '%s', <a href='%s'>follow this link</a> to change your password. Ignore this if you didn't request a password recovery.",
user.getName(), callbackUrl(user, publicUrl));