Skip to content

Setting whitelists using env WHITELIST does not work on Vercel (env not in $_SERVER) #911

Description

@myl7

Describe the bug
Setting env WHITELIST does not work on Vercel.
The instance still serves every username.

To Reproduce

  1. Fork the repo, go to Vercel, and deploy with a GitHub token
  2. Setting env WHITELIST in the Vercel's env panel
  3. Open https://<domain>/?user=<some-other-user>
  4. The figure still renders. it should be rejected.

Expected behavior
Only usernames in WHITELIST are served.

Screenshots
N/A

Desktop (please complete the following information):

Unrelated to the case.

  • OS: [e.g. iOS]
  • Browser [e.g. chrome, safari]
  • Version [e.g. 22]

Smartphone (please complete the following information):

Unrelated to the case.

  • Device: [e.g. iPhone6]
  • OS: [e.g. iOS8.1]
  • Browser [e.g. stock browser, safari]
  • Version [e.g. 22]

Additional context

$whitelist = array_map("trim", array_filter(explode(",", $_SERVER["WHITELIST"] ?? "")));

Whitelists are loaded via $_SERVER["WHITELIST"], which does not contain the env particularly on Vercel.
I would suggest changing to $_ENV["WHITELIST"].

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions