block/check-safety
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(frontend-check): allowlist /api/push/upload multipart fetch (restore wizard)

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-07-05 23:00:33 +08:00
parent 8418d2535b
commit 1693ced112
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
frontend.go
View File

@ -78,6 +78,7 @@ var knownNonProtoFetches = map[string]bool{
"/api/ai/chat/stream": true, // AI chat SSE streaming (EventSource/fetch — ConnectRPC doesn't support SSE) "/api/ai/chat/stream": true, // AI chat SSE streaming (EventSource/fetch — ConnectRPC doesn't support SSE)
"/api/support/": true, // CMS helpdesk widget: multipart attachment upload to the Chi proxy — connect-query can't send FormData "/api/support/": true, // CMS helpdesk widget: multipart attachment upload to the Chi proxy — connect-query can't send FormData
"/api/helpdesk/upload": true, // Orchestrator helpdesk: multipart attachment upload — same FormData limitation "/api/helpdesk/upload": true, // Orchestrator helpdesk: multipart attachment upload — same FormData limitation
"/api/push/upload": true, // Orchestrator push/restore: multipart backup-zip upload — same FormData limitation
"/.well-known/skills/": true, // Public well-known skill discovery index (instance-derived skill name) — no proto service "/.well-known/skills/": true, // Public well-known skill discovery index (instance-derived skill name) — no proto service
} }