From a1f0fc16913603f8a9349b72cfcb8b48feb26205 Mon Sep 17 00:00:00 2001
From: Shashank Verma <shashank.verma2002@gmail.com>
Date: Sun, 24 Sep 2023 13:43:42 +0530
Subject: [PATCH] security: Fix authorization on contextPath

Signed-off-by: Shashank Verma <shashank.verma2002@gmail.com>
---
 .../moticlubs/web/security/SecurityConfig.kt    |   2 +-
 src/main/resources/secrets.yml.gpg              | Bin 585 -> 584 bytes
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/kotlin/com/mnnit/moticlubs/web/security/SecurityConfig.kt b/src/main/kotlin/com/mnnit/moticlubs/web/security/SecurityConfig.kt
index 77512b7..6dd14b0 100644
--- a/src/main/kotlin/com/mnnit/moticlubs/web/security/SecurityConfig.kt
+++ b/src/main/kotlin/com/mnnit/moticlubs/web/security/SecurityConfig.kt
@@ -111,7 +111,7 @@ class SecurityConfig(
                         .map { "$contextPath$it" }
                         .any { reqPath.startsWith(it) } -> Mono.empty()
 
-                    reqPath.startsWith("/$BASE_PATH") -> if (validSession) {
+                    reqPath.startsWith("$contextPath/$BASE_PATH") -> if (validSession) {
                         Mono.empty()
                     } else {
                         Mono.error(UnauthorizedException("Missing firebase auth token"))
diff --git a/src/main/resources/secrets.yml.gpg b/src/main/resources/secrets.yml.gpg
index b4351a51963879eb77d585e59577220d6f69362c..b420702cf9ef8a1a1fde9823bbc49035cd696fb5 100644
GIT binary patch
literal 584
zcmV-O0=NB)4Fm}T2$YBr5f2=3Vd&E70pYCJrQ}4?pdc!dyA)n!*zq`hA|(wPn8Y!`
z9Bc7EL8zCO_csWhNkOV?V<u-bi4m92<QD107BqNFm-~0~$kL>i-x%&dX^p@P6cX91
zQlLLSQ%FI3J_;BX^Y<pYdM6OU1^I}su@3RL@U#PtIK9y8S2pct1{+tycr}>=%Xf*0
z<vK9XIZ}c!eqcGjMQ5+?@`#kv55BV+Q&V5rW<R=wF__`kSXHH`$mK6*SI+43KUExp
zm|Q1U>20+%ACK8LdMMM`(s~Vex<}H^XEE}D{8>BA>dy|(KwP27_!dAXluLsYu-x{e
z9vHJ;YKH30-S>a?wf9EZ;a?kL<$acOyUJT>2Z=v^M{kxGEoqa9Dd%uJ#oUK-eM>do
zDM7Kix~DNUuJUQu0*gCY#A{2Vr<*D+rQh$SeI_;1`}fvo2cjU6_{J(+iOIX^8@s5v
z51*hXP8zKY(p|_tH$M5<zuS?-3SznOBM7o?<Rs&%Io?iY@W@NNs-x~rhZah^^>j)x
zfCfrKHsL<8Ze-CxKRyitTDT;+E@dkaf7>eDzK05cSL{o8tnyWIUV$cg{a)P75g`!)
zGZ(c%`Bwio?*y=BA(JKOoy)3|CZKDH(<iC)KyP^2kU`{TP-6HYJeVscyD4tLQ9XpX
zx8X8Pgf_lJ3Ap(8X2lbhHtVK~9=QA|VoAPfeM-5T<|M}L*6UNvBuAv||NVcWmeRI^
W6+jEWR8FCej3v?f-%}%>!OzPOi6UMA

literal 585
zcmV-P0=E5(4Fm}T2rG8!vp0oSo#@i(0i?`oIIw!v@@+bOkjQDG=D#UPst8unLQ%sC
zu)AP$lwoheh8-#|;bi!qxnq8qMSTQI|8z;foMlIBJB89$td5vq1sXbdC1YjAa`*P|
ze%H`ws>Yoo%RFz>xu~X@>lT?V^h6*G78bPULK@Y-j7~NM>-+-H5k^;Pjmo)M7TxT1
zFi~LX7r8ao|NZ6~l$sCN$v$HYkp71!iZSy}O7;_Hl3>Z9(4L}<RE6AVe<g8SiVbAs
zhELrg;IOfUW3=T*vqCd!iYRes^xS{%s4FwG;-+(4o7#}GrfJO7Q(ZbMtHPXY8^{Sf
zW4jU#I3=+xlPGFTb!wLO@Kd%3o=08L#-6>J?klJ-fJws~_&+Qi)57PEkYj*$2R2SY
z@AKlty3i2<)XP<D<ho{c9(3=EMQxza@_}@^aqnm=Ne(?V%jh)|ZKR2xbnEWWj|g+3
zqJI(7wdR%Kk;j(pH+I4ye5WwT@k>lRWGQz!*hD>;OBfrAXJ}J(X<ED(A`%*ByWONb
z_~?1b2?Rk!9Wv~_-+sUT#sKv{XgF^xRJu<Y1fbRqNuoEvRV#rZ?Op|snvr=_?g?-C
z6obt&3XBs-$eqZz3upVsi!eB1brrCiSWkEQO<?j+BQVr-Z~)QYezH6SbXGs3{!p@r
zxp6&*&EncAM`W$L!xu8!H}z6Tlh%q>C;e4L9-FIxs68?h-Poqf__7fx`=MF44ei`&
XHPWpXBu>yyqMx`t$s;54qn&JhXuKfO