admin login fixed.

2026-07-28 22:56:18 -04:00
parent 5649ab02c7
commit 50c74b9007
29 changed files with 1155 additions and 118 deletions
@@ -43,7 +43,21 @@ function isAllowedDevelopmentOrigin(origin: string) {
  if (process.env.NODE_ENV === 'production') return false
  try {
    const url = new URL(origin)
-    return url.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(url.hostname)
+    if (url.protocol !== 'http:') return false
+
+    const trustedDevPorts = new Set(['3000', '3001', '3002', '3004', '4000'])
+    if (!trustedDevPorts.has(url.port)) return false
+
+    if (['localhost', '127.0.0.1'].includes(url.hostname)) return true
+
+    const octets = url.hostname.split('.').map((part) => Number(part))
+    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+      return false
+    }
+
+    const first = octets[0]!
+    const second = octets[1]!
+    return first === 10 || (first === 172 && second >= 16 && second <= 31) || (first === 192 && second === 168)
  } catch {
    return false
  }