mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-09-20 16:54:18 +01:00
Timothé Stoifl
ce4e35a3d4
The catch block in `access.can()` constructed `errs.PermissionError` without `new`. The error constructors in `backend/lib/error.js` are plain constructor functions that assign to `this` and return nothing, so calling one without `new` evaluates to `undefined`. The statement therefore did `throw undefined`, the express error handler in `backend/app.js` received undefined (and could not read `.status` or `.public` off it), and the request fell through to the catch-all 404 handler in `backend/routes/main.js`. Net effect: every authorization failure raised by `access.can(...)` was reported to clients as `404 Not Found` instead of `403 Forbidden`. Line 45 of the same file already used `new` correctly, which shows this was an oversight rather than deliberate resource-existence hiding. A grep over `backend/` confirms this was the only error constructor invoked without `new`.