diff --git a/config.json b/config.json
index 3791a3a..f534a00 100644
--- a/config.json
+++ b/config.json
@@ -16,10 +16,19 @@
"stackHidden": false,
"enableRemoteLogBrowsing": true,
"exposeServerVersion": true,
- "disableServerSideScriptExpose": false,
+ "disableServerSideScriptExpose": true,
"rewriteMap": [
{
- "definingRegex": "/\\/invoke500\\/\\?/",
+ "definingRegex": "/^\\/serverSideScript\\.js(?:$|[#?])/",
+ "replacements": [
+ {
+ "regex": "/^\\/serverSideScript\\.js($|[#?])/",
+ "replacement": "/NONEXISTENT_PAGE$1"
+ }
+ ]
+ },
+ {
+ "definingRegex": "/^\\/invoke500\\/\\?/",
"replacements": [
{
"regex": "/\\/invoke500\\/\\?/",
@@ -28,7 +37,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\/.+\\//",
+ "definingRegex": "/^\\/invoke500\\/.+\\//",
"replacements": [
{
"regex": "/\\/\\?/",
@@ -45,7 +54,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\/.+/",
+ "definingRegex": "/^\\/invoke500\\/.+/",
"replacements": [
{
"regex": "/\\?/",
@@ -58,7 +67,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\//",
+ "definingRegex": "/^\\/invoke500\\//",
"replacements": [
{
"regex": "/\\/invoke500\\//",
@@ -67,7 +76,7 @@
]
},
{
- "definingRegex": "/\\/invoke500$/",
+ "definingRegex": "/^\\/invoke500$/",
"replacements": [
{
"regex": "/\\/invoke500/",
diff --git a/index.html b/index.html
index a621d7f..3ab3848 100644
--- a/index.html
+++ b/index.html
@@ -1,7 +1,7 @@
- SVR.JS 3.8.0
+ SVR.JS 3.8.1
- Welcome to SVR.JS 3.8.0
+ Welcome to SVR.JS 3.8.1
@@ -40,8 +40,16 @@
"exposeServerVersion": true,
"disableServerSideScriptExpose": false,
"rewriteMap": [
+ "definingRegex": "/^\\/serverSideScript\\.js(?:$|[#?])/",
+ "replacements": [
+ {
+ "regex": "/^\\/serverSideScript\\.js($|[#?])/",
+ "replacement": "/NONEXISTENT_PAGE$1"
+ }
+ ]
+ },
{
- "definingRegex": "/\\/invoke500\\/\\?/",
+ "definingRegex": "/^\\/invoke500\\/\\?/",
"replacements": [
{
"regex": "/\\/invoke500\\/\\?/",
@@ -50,7 +58,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\/.+\\//",
+ "definingRegex": "/^\\/invoke500\\/.+\\//",
"replacements": [
{
"regex": "/\\/\\?/",
@@ -67,7 +75,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\/.+/",
+ "definingRegex": "/^\\/invoke500\\/.+/",
"replacements": [
{
"regex": "/\\?/",
@@ -80,7 +88,7 @@
]
},
{
- "definingRegex": "/\\/invoke500\\//",
+ "definingRegex": "/^\\/invoke500\\//",
"replacements": [
{
"regex": "/\\/invoke500\\//",
@@ -89,15 +97,14 @@
]
},
{
- "definingRegex": "/\\/invoke500$/",
+ "definingRegex": "/^\\/invoke500$/",
"replacements": [
{
"regex": "/\\/invoke500/",
"replacement": "/invoke500.svr"
}
]
- }
- ],
+ }
],
"allowStatus": true,
"dontCompress": ["/.*\\.ipxe$/","/.*\\.img$/","/.*\\.iso$/"],
"enableIPSpoofing": false,
@@ -110,11 +117,8 @@
Changes:
- - Added partial virtual hosting support
- - Added host field to nonStandardCodes and rewriteMap properties.
- - Added userList field to nonStandardCodes properties (with scode set to 401).
- - Added new config.json properties: errorPages, enableDirectoryListingVHost and customHeadersVHost.
- - Improved HTTP authentication error handling.
+ - Changed default SVR.JS configuration.
+ - Disabled server-side script exposure by default.
Bugs:
diff --git a/licenses/index.html b/licenses/index.html
index fa3a490..2c5c339 100644
--- a/licenses/index.html
+++ b/licenses/index.html
@@ -1,7 +1,7 @@
- SVR.JS 3.8.0 Licenses
+ SVR.JS 3.8.1 Licenses
- SVR.JS 3.8.0 Licenses
- SVR.JS 3.8.0
+ SVR.JS 3.8.1 Licenses
+ SVR.JS 3.8.1
MIT License
@@ -37,7 +37,7 @@
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
- Packages used by SVR.JS 3.8.0 and utilities
+ Packages used by SVR.JS 3.8.1 and utilities
License: MIT
diff --git a/svr.js b/svr.js
index 773000f..b867f30 100644
--- a/svr.js
+++ b/svr.js
@@ -81,7 +81,7 @@ function deleteFolderRecursive(path) {
}
var os = require("os");
-var version = "3.8.0";
+var version = "3.8.1";
var singlethreaded = false;
if (process.versions) process.versions.svrjs = version; //Inject SVR.JS into process.versions
@@ -4643,7 +4643,7 @@ if (!cluster.isPrimary) {
callServerError(403);
serverconsole.errmessage("Access to SVR.JS script is denied.");
return;
- } else if ((isForbiddenPath(decodedHref, "svrjs") || isForbiddenPath(decodedHref, "serverSideScripts") || isIndexOfForbiddenPath(decodedHref, "serverSideScriptDirectories")) && !isProxy && (configJSON.disableServerSideScriptExpose && configJSON.disableServerSideScriptExpose != undefined)) {
+ } else if ((isForbiddenPath(decodedHref, "svrjs") || isForbiddenPath(decodedHref, "serverSideScripts") || isIndexOfForbiddenPath(decodedHref, "serverSideScriptDirectories")) && !isProxy && (configJSON.disableServerSideScriptExpose || configJSON.disableServerSideScriptExpose === undefined)) {
callServerError(403);
serverconsole.errmessage("Access to sources is denied.");
return;
@@ -5789,7 +5789,7 @@ function saveConfig() {
if (configJSONobj.stackHidden === undefined) configJSONobj.stackHidden = false;
if (configJSONobj.enableRemoteLogBrowsing === undefined) configJSONobj.enableRemoteLogBrowsing = true;
if (configJSONobj.exposeServerVersion === undefined) configJSONobj.exposeServerVersion = true;
- if (configJSONobj.disableServerSideScriptExpose === undefined) configJSONobj.disableServerSideScriptExpose = false;
+ if (configJSONobj.disableServerSideScriptExpose === undefined) configJSONobj.disableServerSideScriptExpose = true;
if (configJSONobj.allowStatus === undefined) configJSONobj.allowStatus = true;
if (configJSONobj.rewriteMap === undefined) configJSONobj.rewriteMap = [];
if (configJSONobj.dontCompress === undefined) configJSONobj.dontCompress = [];
diff --git a/tests.html b/tests.html
index 1996bfc..4e58628 100644
--- a/tests.html
+++ b/tests.html
@@ -1,7 +1,7 @@
-
SVR.JS 3.8.0 Tests
+ SVR.JS 3.8.1 Tests
- SVR.JS 3.8.0 Tests
+ SVR.JS 3.8.1 Tests
Directory
Directory (with query)