Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b21c8978ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| q.Set("gen_cmd", cmd) | ||
| } | ||
| http.Redirect(w, r, panelPath+"?"+q.Encode(), http.StatusFound) |
There was a problem hiding this comment.
In handleGenInstallCmd, the generated shell command (which includes --init-token) is placed into gen_cmd and then sent via 302 query string back to the admin page. That makes the token appear in browser history and typical access logs/proxy logs, so a credential that can authorize new client registration is leaked beyond the page itself. Render this value without putting it in the URL (for example, server-side flash state or direct template render after POST).
Useful? React with 👍 / 👎.
| panelURL := fmt.Sprintf("%s://%s", requestScheme(r), r.Host) | ||
| cmd := "curl --proto '=https' --tlsv1.2 -fsSL " + |
There was a problem hiding this comment.
The install command now builds --server-url from requestScheme(r) and r.Host, which can be an internal HTTP upstream address when the panel is behind a reverse proxy that does TLS termination or host rewriting without forwarding headers. In that deployment pattern, generated commands point clients to an unreachable/wrong endpoint, whereas the previous browser-side generation used the externally visible URL. Use a canonical configured public URL (or robust forwarded-header parsing) for command generation.
Useful? React with 👍 / 👎.
1 participant
Codex generated this pull request, but encountered an unexpected error after generation. This is a placeholder PR message.
Codex Task