From a58dcc6f19cf0f1ea27c0042f6e229d7bb3ff8af Mon Sep 17 00:00:00 2001
From: schroda <50052685+schroda@users.noreply.github.com>
Date: Fri, 23 Jan 2026 17:30:29 +0100
Subject: [PATCH] Prevent subpath injection with disabled setting (#1869)

---
 .../suwayomi/tachidesk/server/util/WebInterfaceManager.kt     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/main/kotlin/suwayomi/tachidesk/server/util/WebInterfaceManager.kt b/server/src/main/kotlin/suwayomi/tachidesk/server/util/WebInterfaceManager.kt
index ba1c6780..c3d26a76 100644
--- a/server/src/main/kotlin/suwayomi/tachidesk/server/util/WebInterfaceManager.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/server/util/WebInterfaceManager.kt
@@ -204,12 +204,12 @@ object WebInterfaceManager {
         val tempWebUIRoot = createServableDirectory()
         val orgIndexHtml = File("$tempWebUIRoot/index.html")
 
-        if (orgIndexHtml.exists()) {
+        if (ServerSubpath.isDefined() && orgIndexHtml.exists()) {
             val originalIndexHtml = orgIndexHtml.readText()
             val subpathInjectionScript =
                 """
                 <script>
-                    "// <<suwayomi-subpath-injection>>"
+                    // <<suwayomi-subpath-injection>>
                     const baseTag = document.createElement('base');
                     baseTag.href = location.origin + "${ServerSubpath.asRootPath()}";
                     document.head.appendChild(baseTag);