doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Public Studio: the checkout's .git is not served (fs.deny), with Vite's defaults kept

Browse source 
The resolved config in ACCESS=public (Vite 5.4.21) had strict file serving with /app/repo as the only
allowed root, and a deny list of Vite's defaults (.env, .env.*, certificates). The .git folder sat
inside the allowed root and was not denied, so a public Studio could serve the repository's git
internals. In public mode the deny list adds **/.git/**; the defaults are restated because setting
deny replaces them.
This commit is contained in:
Doxa Maps 2026-09-29 05:07:45 +00:00
parent f1500a37c2
commit 28c4bacd2a
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
deployment/cloud/vite.cloud.config.mjs
View file

@ -81,6 +81,9 @@ export default async (e) => {
allowedHosts: true,
...(hmr ? { hmr } : {}),
...(PUBLIC ? { proxy: { '^/(cdn|api-prod|pb|admin)/': { target: 'http://127.0.0.1:5175', ws: true } } } : {}),
// Public: the checkout's git internals are not served either (the private history, .git/config). Vite's
// defaults are restated because setting deny replaces them.
...(PUBLIC ? { fs: { strict: true, deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**'] } } : {}),
},
})
}