Merge pull request #1240 from openziti/fix-interstitial-ua-prefix-bypass

Fix interstitial handling when UserAgentPrefixes is configured.

CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## v2.0.3
+
+FIX: Frontends configured with `interstitial.user_agent_prefixes` no longer suppress the interstitial page for all requests. The prefix list is now correctly evaluated as an allow-list of User-Agents that should receive the page; if the list is empty all User-Agents receive it, matching the documented behavior.
+
 ## v2.0.2
 
 FIX: The `drive` backend mode WebDAV implementation now prevents symlink traversal outside the configured shared directory. `Stat`, `OpenFile`, `Mkdir`, `RemoveAll`, and `Rename` now reject symlinks that resolve outside the drive root while continuing to allow symlinks that resolve within that tree. This fixes GHSA-74m3-9qvm-rp9h.

endpoints/dynamicProxy/http.go

@@ -253,6 +253,7 @@ func handleInterstitial(w http.ResponseWriter, r *http.Request, pcfg *config, cf
 
 	sendInterstitial := true
 	if len(pcfg.Interstitial.UserAgentPrefixes) > 0 {
+		sendInterstitial = false
 		ua := r.Header.Get("User-Agent")
 		for _, prefix := range pcfg.Interstitial.UserAgentPrefixes {
 			if strings.HasPrefix(ua, prefix) {
@@ -260,7 +261,6 @@ func handleInterstitial(w http.ResponseWriter, r *http.Request, pcfg *config, cf
 				break
 			}
 		}
-		sendInterstitial = false
 	}
 
 	if sendInterstitial {

endpoints/publicProxy/http.go

@@ -229,6 +229,7 @@ func handleInterstitial(w http.ResponseWriter, r *http.Request, pcfg *Config, cf
 
 	sendInterstitial := true
 	if len(pcfg.Interstitial.UserAgentPrefixes) > 0 {
+		sendInterstitial = false
 		ua := r.Header.Get("User-Agent")
 		for _, prefix := range pcfg.Interstitial.UserAgentPrefixes {
 			if strings.HasPrefix(ua, prefix) {
@@ -236,7 +237,6 @@ func handleInterstitial(w http.ResponseWriter, r *http.Request, pcfg *Config, cf
 				break
 			}
 		}
-		sendInterstitial = false
 	}
 
 	if sendInterstitial {