[media] refused out-of-root request: ~/.cache/nobilis/kick-emotes/5273243.gif - the path is inside the allowed root; the file simply does not exist. isAllowed treats a failed realpath as a refusal, so a missing file and an attack on the media boundary log the same line.
Two things:
Log a missing file as missing, and answer it as a 404, not a refusal.
Find why an emote is referenced before (or without) its file being on disk: the emote draws as a broken image. Seen twice in the current log.
`[media] refused out-of-root request: ~/.cache/nobilis/kick-emotes/5273243.gif` - the path is inside the allowed root; the file simply does not exist. `isAllowed` treats a failed realpath as a refusal, so a missing file and an attack on the media boundary log the same line.
Two things:
- Log a missing file as missing, and answer it as a 404, not a refusal.
- Find why an emote is referenced before (or without) its file being on disk: the emote draws as a broken image. Seen twice in the current log.
Salastil
added this to the v1.0 milestone 2026-10-01 23:59:57 -04:00
Salastil
added the bug label 2026-10-01 23:59:57 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
[media] refused out-of-root request: ~/.cache/nobilis/kick-emotes/5273243.gif- the path is inside the allowed root; the file simply does not exist.isAllowedtreats a failed realpath as a refusal, so a missing file and an attack on the media boundary log the same line.Two things:
Finished
70cd8d707f0a6b566b7e