v0.34.4

src/admin/web/vhosts/render.js

@@ -561,6 +561,15 @@ form.addEventListener("submit", async event => {
     if (epoch !== draftEpoch || revision !== envelope.revision || !dialog.open) throw new Error(t("stale"));
     const value = collect(), next = structuredClone(envelope.config); next.vhosts ||= [];
     const debugIssues = debugOriginIssues(value.backends); if (debugIssues.length && !(await appConfirm(`${t("vhDebugOriginMismatch")}\n\n${debugIssues.map(member => member.id).join(", ")}`, { danger: true }))) return;
+    const oldVhost = (envelope.config.vhosts || []).find(v => v.id === editing);
+    // A previous acceptance must not silently authorize new hostnames or a different certificate.
+    const certificateScope = item => JSON.stringify({
+      certificate: item?.certificate_id || null,
+      hosts: [...(item?.frontend?.hosts || [])].map(v => v.toLowerCase().replace(/\.$/, "")).sort(),
+      wwwRedirect: item?.www_redirect === true,
+      wwwTarget: item?.www_redirect_target || null
+    });
+    if (value.allow_certificate_mismatch && (!oldVhost?.allow_certificate_mismatch || certificateScope(value) !== certificateScope(oldVhost)) && !(await appConfirm(t("vhCertificateMismatchConfirm"), { danger: true }))) return;
     if (next.vhosts.some(v => v.id === value.id && v.id !== editing)) throw new Error(t("vhConflict"));
     if (editing && value.id !== editing && !(await appConfirm(t("vhIdRenameConfirm").replace("{old}", editing).replace("{new}", value.id), { danger: true }))) return;
     const addsCertificate = stagedCertificates.some(c => c.id === value.certificate_id);