From 82b53fc4f5ed3365ae2fb9573716db0fc1ccdf4f Mon Sep 17 00:00:00 2001
From: Tommaso Casaburi <tom@bitsocial.net>
Date: Sat, 30 May 2026 12:13:21 +0700
Subject: [PATCH] fix(webui): strip 5chan root hash redirect

---
 src/webui/daemon-server.ts | 5 ++++-
 test/cli/daemon.test.ts    | 6 ++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/webui/daemon-server.ts b/src/webui/daemon-server.ts
index 56e3511..6c50431 100644
--- a/src/webui/daemon-server.ts
+++ b/src/webui/daemon-server.ts
@@ -9,10 +9,13 @@ import { randomBytes } from "crypto";
 import express from "express";
 import { loadChallengesIntoPKC } from "../challenge-packages/challenge-utils.js";
 
+const rootHashRedirectScriptPattern =
+    /<script\b[^>]*>(?:(?!<\/script>)[\s\S])*?window\.location\.replace\(["']\/#["']\s*\+\s*window\.location\.pathname\s*\+\s*window\.location\.search\);(?:(?!<\/script>)[\s\S])*?<\/script>/;
+
 async function _generateModifiedIndexHtmlWithRpcSettings(webuiPath: string, webuiName: string, ipfsGatewayPort: number) {
     const indexHtmlString = (await fs.readFile(path.join(webuiPath, "index_backup_no_rpc.html")))
         .toString()
-        .replace(/<script>\s*\/\/\s*Redirect non-hash URLs[\s\S]*?<\/script>/, "");
+        .replace(rootHashRedirectScriptPattern, "");
     const defaultRpcOptionString = `[window.location.origin.replace("https://", "wss://").replace("http://", "ws://") + window.location.pathname.split('/' + '${webuiName}')[0]]`;
     // Ipfs media only locally because ipfs gateway doesn't allow remote connections
     const defaultIpfsMedia = `if (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname === "0.0.0.0")window.defaultMediaIpfsGatewayUrl = 'http://' + window.location.hostname + ':' + ${ipfsGatewayPort}`;
diff --git a/test/cli/daemon.test.ts b/test/cli/daemon.test.ts
index ef7d61a..3a43ccb 100644
--- a/test/cli/daemon.test.ts
+++ b/test/cli/daemon.test.ts
@@ -715,11 +715,13 @@ describe(`bitsocial daemon webui`, async () => {
         await stopPkcDaemon(daemonProcess);
     });
 
-    it(`5chan webui does not contain the hash redirect script`, async () => {
+    it(`5chan webui does not contain the root hash redirect script`, async () => {
         const res = await fetch(`http://localhost:${rpcUrl.port}/5chan`);
         expect(res.status).toBe(200);
         const html = await res.text();
-        expect(html).not.toMatch(/Redirect non-hash URLs/);
+        expect(html).not.toMatch(
+            /window\.location\.replace\(["']\/#["']\s*\+\s*window\.location\.pathname\s*\+\s*window\.location\.search\)/
+        );
     });
 
     it(`POST /api/challenges/reload returns 200 for local connections`, async () => {