web/cryptpad
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

abstract checks for authenticated RPCs

Browse Source
This commit is contained in:
ansuz
2017-05-31 12:51:26 +02:00
parent d774f8771b
commit 82f5d3c96f
1 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
rpc.js
View File

@@ -785,6 +785,24 @@ var upload_status = function (Env, publicKey, filesize, cb) {
}); });
}; };
var isAuthenticatedCall = function (call) {
return [
//'COOKIE',
'RESET',
'PIN',
'UNPIN',
'GET_HASH',
'GET_TOTAL_SIZE',
'GET_FILE_SIZE',
'UPDATE_LIMITS',
'GET_LIMIT',
'GET_MULTIPLE_FILE_SIZE',
'UPLOAD',
'UPLOAD_COMPLETE',
'UPLOAD_CANCEL',
].indexOf(call) !== -1;
};
/*::const ConfigType = require('./config.example.js');*/ /*::const ConfigType = require('./config.example.js');*/
RPC.create = function (config /*:typeof(ConfigType)*/, cb /*:(?Error, ?Function)=>void*/) { RPC.create = function (config /*:typeof(ConfigType)*/, cb /*:(?Error, ?Function)=>void*/) {
// load pin-store... // load pin-store...
@@ -840,7 +858,6 @@ RPC.create = function (config /*:typeof(ConfigType)*/, cb /*:(?Error, ?Function)
beginSession(Sessions, publicKey); beginSession(Sessions, publicKey);
var cookie = msg[0]; var cookie = msg[0];
if (!isValidCookie(Sessions, publicKey, cookie)) { if (!isValidCookie(Sessions, publicKey, cookie)) {
// no cookie is fine if the RPC is to get a cookie // no cookie is fine if the RPC is to get a cookie
if (msg[1] !== 'COOKIE') { if (msg[1] !== 'COOKIE') {
@@ -854,8 +871,10 @@ RPC.create = function (config /*:typeof(ConfigType)*/, cb /*:(?Error, ?Function)
return void respond('INVALID_MESSAGE_OR_PUBLIC_KEY'); return void respond('INVALID_MESSAGE_OR_PUBLIC_KEY');
} }
if (checkSignature(serialized, signature, publicKey) !== true) { if (isAuthenticatedCall(msg[1])) {
return void respond("INVALID_SIGNATURE_OR_PUBLIC_KEY"); if (checkSignature(serialized, signature, publicKey) !== true) {
return void respond("INVALID_SIGNATURE_OR_PUBLIC_KEY");
}
} }
var safeKey = escapeKeyCharacters(publicKey); var safeKey = escapeKeyCharacters(publicKey);