throwarray / fivem-http-server Goto Github PK

Hey!

Looks like an awesome script.
How i should use it? There's a wiki?

Thank you!

Using .. within the request path allows someone to get arbitrary files from the server.

For example, assuming the resource is installed in resources/[local]/http-server, then:

GET /http-server/../../../../server.cfg HTTP/1.1

would allow anyone to read your server.cfg.

The runcode resource from cfx-server-data prevents this by stripping out any occurrences of .. from the path:
https://github.com/citizenfx/cfx-server-data/blob/b907aa74e2826e363979332ac21b9ad98cd82aa1/resources/%5Bsystem%5D/runcode/runcode_web.lua#L188-L189

HI
Script is installed, fivem server running, when I go to http://ip:30120/http-server I get Route /http-server not found.