Redirecting to 0.0.0.0:8080 when logout ore user change. about karadav HOT 7 CLOSED

You have to manually configure the WWW_URL constant inside the config.local.php, as KaraDAV has no way of detecting the server address this way.

For example for testing I use:

const WWW_URL = 'http://192.168.43.171:8080/';

from karadav.

Yeah but would it not be better to have auto detection on the client side in case of a proxy or port mapping like docker.

from karadav.

There's auto-detection on the server side currently, the client cannot be trusted or it might open to flaws like open redirects.

I added instructions in INSTALL.md on how to configure WWW_URL accordingly.

If you have better detection code, then you're welcome for a PR, thank you :)

from karadav.

Because i dont see any client to server comunication for the path that is needed you cloud just use window.location.origin on the client which has no open redirect vuln

from karadav.

The redirect happens on the server side, so there is no safe way to get the URL from the client in a trusted way.

from karadav.

So why not just use a client side javascript and sanatize it before display.

from karadav.

There is no way to do that safely.

from karadav.