From 85bc805219790f68992c54f1e89737e2d65e8d4c Mon Sep 17 00:00:00 2001
From: Dorian Niemiec <dorian.niemiec@svrjs.org>
Date: Thu, 7 Sep 2023 21:04:50 +0200
Subject: [PATCH] Update to SVR.JS 3.4.31

---
 index.html          |  2 +-
 licenses/index.html |  8 ++++----
 svr.js              | 15 ++++++++++++---
 tests.html          |  4 ++--
 4 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/index.html b/index.html
index 5aa2aeb..83a6f7c 100644
--- a/index.html
+++ b/index.html
@@ -119,7 +119,7 @@
     </div>
     <p>Changes:</p>
     <ul>
-      <li>Mitigated security vulnerability: SVR.JS mods and server-side JavaScript using req.url are no longer vulnerable to path traversal (not including query strings).</li>
+      <li>Mitigated security vulnerability: SVR.JS mods and server-side JavaScript not using href or uobject.pathname in some path checks are no longer vulnerable to access control bypass (from SVR.JS configuration).</li>
     </ul>
     <p>Bugs:</p>
     <ul>
diff --git a/licenses/index.html b/licenses/index.html
index 6fbfb5f..274967d 100644
--- a/licenses/index.html
+++ b/licenses/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>SVR.JS 3.4.30 Licenses</title>
+    <title>SVR.JS 3.4.31 Licenses</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta charset="UTF-8" />
     <style>
@@ -12,8 +12,8 @@
     </style>
   </head>
   <body>
-    <h1>SVR.JS 3.4.30 Licenses</h1>
-    <h2>SVR.JS 3.4.30</h2>
+    <h1>SVR.JS 3.4.31 Licenses</h1>
+    <h2>SVR.JS 3.4.31</h2>
     <div style="display: inline-block; text-align: left; border-width: 2px; border-style: solid; border-color: gray; padding: 8px;">
       MIT License<br/>
       <br/>
@@ -37,7 +37,7 @@
       OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE<br/>
       SOFTWARE.<br/>
     </div>
-    <h2>Packages used by SVR.JS 3.4.30 and utilities</h2>
+    <h2>Packages used by SVR.JS 3.4.31 and utilities</h2>
     <div style="width: 100%; background-color: #ccc; border: 1px solid green; text-align: left; margin: 10px 0;">
       <div style="float: right;">License: MIT</div>
       <div style="font-size: 20px;">
diff --git a/svr.js b/svr.js
index 5c95d6a..88d3ed6 100644
--- a/svr.js
+++ b/svr.js
@@ -71,7 +71,7 @@ function deleteFolderRecursive(path) {
 }
 
 var os = require("os");
-var version = "3.4.30";
+var version = "3.4.31";
 var singlethreaded = false;
 
 if (process.versions) process.versions.svrjs = version; //Inject SVR.JS into process.versions
@@ -3217,8 +3217,17 @@ if (!cluster.isPrimary) {
       //MOD EXCECUTION FUNCTION
       function modExecute(mods, ffinals) {
         var modFunction = ffinals;
-        for (var i = mods.length - 1; i >= 0; i--) {
-          modFunction = mods[i].callback(req, res, serverconsole, responseEnd, href, ext, uobject, search, "index.html", users, page404, head, foot, fd, modFunction, configJSON, callServerError, getCustomHeaders, origHref, redirect, parsePostData);
+        var useMods = mods;
+        
+        if(isProxy) {
+          useMods = [];
+          for (var i = 0; i < mods.length; i++) {
+            if (mods[i].proxyCallback !== undefined) proxyMods.push(mods[i]);
+          }
+        }
+        
+        for (var i = useMods.length - 1; i >= 0; i--) {
+          modFunction = useMods[i].callback(req, res, serverconsole, responseEnd, href, ext, uobject, search, "index.html", users, page404, head, foot, fd, modFunction, configJSON, callServerError, getCustomHeaders, origHref, redirect, parsePostData);
         }
         modFunction();
       }
diff --git a/tests.html b/tests.html
index bdc4afa..b00852a 100644
--- a/tests.html
+++ b/tests.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>SVR.JS 3.4.30 Tests</title>
+    <title>SVR.JS 3.4.31 Tests</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta charset="UTF-8" />
     <style>
@@ -12,7 +12,7 @@
     </style>
   </head>
   <body>
-    <h1>SVR.JS 3.4.30 Tests</h1>
+    <h1>SVR.JS 3.4.31 Tests</h1>
     <h2>Directory</h2>
     <iframe src="/testdir" width="50%" height="300px"></iframe>
     <h2>Directory (with query)</h2>
