fix!: check https with `X-Forwarded-Proto`

not read old setting `api_url` and `base_path` from this commit

internal/conf/const.go

@@ -11,8 +11,6 @@ const (
 const (
 	// site
 	VERSION      = "version"
-	ApiUrl       = "api_url"
-	BasePath     = "base_path"
 	SiteTitle    = "site_title"
 	Announcement = "announcement"
 	AllowIndexed = "allow_indexed"

server/common/base.go

@@ -3,24 +3,27 @@ package common
 import (
 	"fmt"
 	"net/http"
+	stdpath "path"
 	"strings"
 
 	"github.com/alist-org/alist/v3/internal/conf"
-	"github.com/alist-org/alist/v3/internal/setting"
 )
 
 func GetApiUrl(r *http.Request) string {
 	api := conf.Conf.SiteURL
-	if api == "" {
+	if strings.HasPrefix(api, "http") {
-		api = setting.GetStr(conf.ApiUrl)
+		return api
 	}
 	if r != nil && api == "" {
 		protocol := "http"
-		if r.TLS != nil {
+		if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
 			protocol = "https"
 		}
-		api = fmt.Sprintf("%s://%s", protocol, r.Host)
+		host := r.Host
-
+		if r.Header.Get("X-Forwarded-Host") != "" {
+			host = r.Header.Get("X-Forwarded-Host")
+		}
+		api = fmt.Sprintf("%s://%s", protocol, stdpath.Join(host, api))
 	}
 	strings.TrimSuffix(api, "/")
 	return api

server/static/config.go

@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/alist-org/alist/v3/internal/conf"
-	"github.com/alist-org/alist/v3/internal/setting"
 	"github.com/alist-org/alist/v3/pkg/utils"
 )
 
@@ -25,11 +24,6 @@ func getSiteConfig() SiteConfig {
 		BasePath: u.Path,
 		Cdn:      strings.ReplaceAll(strings.TrimSuffix(conf.Conf.Cdn, "/"), "$version", conf.WebVersion),
 	}
-	// try to get old config
-	if siteConfig.ApiURL == "" {
-		siteConfig.ApiURL = setting.GetStr(conf.ApiUrl)
-		siteConfig.BasePath = setting.GetStr(conf.BasePath)
-	}
 	if siteConfig.BasePath != "" {
 		siteConfig.BasePath = utils.FixAndCleanPath(siteConfig.BasePath)
 	}