From 99678969b3fc51804e4e020373b36b1502cbeacb Mon Sep 17 00:00:00 2001
From: Jamie Curnow <jc@jc21.com>
Date: Mon, 9 Nov 2026 22:04:32 +1000
Subject: [PATCH] Fix a proxy host whose access list can't be loaded is now
 denied to

everyone instead of being served with no restrictions
---
 backend/internal/nginx.js      | 15 +++++++++++++--
 backend/templates/_access.conf |  5 +++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/backend/internal/nginx.js b/backend/internal/nginx.js
index 378b53591..0ba90b0e8 100644
--- a/backend/internal/nginx.js
+++ b/backend/internal/nginx.js
@@ -183,6 +183,16 @@ const internalNginx = {
 					}
 					if (locationAccessList) {
 						locationCopy.access_list = locationAccessList;
+					} else if (
+						locationCopy.access_list_id > 0 &&
+						locationCopy.access_list_id !== host.access_list?.id
+					) {
+						// The location names its own list but it's gone. Don't fall back to the
+						// host's (possibly less restrictive) list; _access.conf denies all instead.
+						logger.error(
+							`Proxy Host #${host.id} location "${locationCopy.path}" references Access List #${locationCopy.access_list_id} which does not exist, all access will be denied`,
+						);
+						locationCopy.access_list = null;
 					} else {
 						locationCopy.access_list_id = host.access_list_id;
 						locationCopy.access_list = host.access_list;
@@ -338,8 +348,9 @@ const internalNginx = {
 			}
 
 			if (!host.access_list) {
-				logger.warn(
-					`Proxy Host #${host.id} references Access List #${host.access_list_id} which does not exist`,
+				// _access.conf renders "deny all" when the list is missing, so fail closed
+				logger.error(
+					`Proxy Host #${host.id} references Access List #${host.access_list_id} which does not exist, all access will be denied`,
 				);
 			} else if (!host.access_list.clients.length && !host.access_list.items.length) {
 				logger.warn(
diff --git a/backend/templates/_access.conf b/backend/templates/_access.conf
index 81983f3a3..7ae905472 100644
--- a/backend/templates/_access.conf
+++ b/backend/templates/_access.conf
@@ -1,4 +1,5 @@
 {% if access_list_id > 0 %}
+  {% if access_list %}
     {% if access_list.items.length > 0 %}
     # Authorization
     auth_basic            "Authorization required";
@@ -24,4 +25,8 @@
     {% else %}
     satisfy all;
     {% endif %}
+  {% else %}
+    # Access List #{{ access_list_id }} could not be loaded: deny rather than serve unrestricted
+    deny all;
+  {% endif %}
 {% endif %}