From 679c7a039f5f83873d31360fd3f399f9b3c0046b Mon Sep 17 00:00:00 2001 From: Arena Agent Date: Tue, 11 Aug 2026 16:38:54 +0000 Subject: [PATCH] Fix DDNS URL validation: replace ${IP} temporarily for validator, keep placeholder for storage --- app/sovran_systemsos_web/server.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/sovran_systemsos_web/server.py b/app/sovran_systemsos_web/server.py index 48788cf..c21d90b 100644 --- a/app/sovran_systemsos_web/server.py +++ b/app/sovran_systemsos_web/server.py @@ -4730,9 +4730,11 @@ async def api_domains_set(req: DomainSetRequest): # Replace trailing &auto with the IP placeholder used by _run_njalla_ddns if ddns_url.endswith("&auto"): ddns_url = ddns_url[:-5] + "&a=${IP}" - # Validate URL strictly — reject injection attempts before persisting + # Validate URL strictly — reject injection attempts before persisting. + # The placeholder ${IP} is replaced temporarily so the validator sees a + # real address; the original URL (with the placeholder) is kept for storage. try: - ddns_url = _validate_ddns_url(ddns_url) + _validate_ddns_url(ddns_url.replace("${IP}", "127.0.0.1")) except ValueError as exc: raise HTTPException(status_code=400, detail=f"Invalid DDNS URL: {exc}") # Persist the URL in the JSON store (never in executable shell source)