web/cryptpad
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

forbid cache poisoning via botched reset calls

Browse Source
This commit is contained in:
ansuz
2017-06-28 11:36:34 +02:00
parent 7439bbaba2
commit 9d83214158
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
rpc.js
View File

@@ -578,8 +578,7 @@ var resetUserPins = function (Env, publicKey, channelList, cb) {
}); });
} }
var pins = session.channels = {}; var pins = {};
getMultipleFileSize(Env, channelList, function (e, sizes) { getMultipleFileSize(Env, channelList, function (e, sizes) {
if (e) { return void cb(e); } if (e) { return void cb(e); }
var pinSize = sumChannelSizes(sizes); var pinSize = sumChannelSizes(sizes);
@@ -606,6 +605,8 @@ var resetUserPins = function (Env, publicKey, channelList, cb) {
pins[channel] = true; pins[channel] = true;
}); });
// update in-memory cache IFF the reset was allowed.
session.channels = pins;
getHash(Env, publicKey, function (e, hash) { getHash(Env, publicKey, function (e, hash) {
cb(e, hash); cb(e, hash);
}); });