Fix auth bypass: normalize URL path to lowercase before JWT/auth checks

Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>

back/loaders/express.ts

@@ -22,6 +22,14 @@ export default ({ app }: { app: Application }) => {
     app.use(rewrite(`${config.baseUrl}/*`, '/$1'));
   }
   
+  // Normalize URL path to lowercase to prevent authentication bypass via mixed-case paths
+  // e.g. /API/system/command-run should not bypass JWT checks designed for /api/...
+  // The regex only matches the path portion (stops at ? or #), preserving query strings.
+  app.use((req: Request, res: Response, next: NextFunction) => {
+    req.url = req.url.replace(/^[^?#]*/, (p) => p.toLowerCase());
+    next();
+  });
+
   app.get(`${config.api.prefix}/env.js`, serveEnv);
   app.use(`${config.api.prefix}/static`, express.static(config.uploadPath));
 

shell/share.sh

@@ -258,16 +258,8 @@ git_clone_scripts() {
 
   set_proxy "$proxy"
 
-  # Set TMPDIR to /tmp to avoid "unable to get random bytes" error in some Docker environments
-  local original_tmpdir="${TMPDIR:-}"
-  export TMPDIR=/tmp
   git clone -q --depth=1 $part_cmd $url $dir
   exit_status=$?
-  if [[ -n "$original_tmpdir" ]]; then
-    export TMPDIR="$original_tmpdir"
-  else
-    unset TMPDIR
-  fi
 
   unset_proxy
 }