web/cryptpad
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

restrict access to metadata

Browse Source
This commit is contained in:
ansuz
2020-02-21 10:31:10 -05:00
parent ad7096d754
commit fe0e02a421
4 changed files with 38 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/rpc.js
View File

@@ -19,15 +19,15 @@ const UNAUTHENTICATED_CALLS = {
GET_DELETED_PADS: Pinning.getDeletedPads,
IS_CHANNEL_PINNED: Pinning.isChannelPinned,
IS_NEW_CHANNEL: Channel.isNewChannel,
WRITE_PRIVATE_MESSAGE: Channel.writePrivateMessage, // XXX RESTRICT
GET_METADATA: Metadata.getMetadata, // XXX RESTRICT
WRITE_PRIVATE_MESSAGE: Channel.writePrivateMessage,
GET_METADATA: Metadata.getMetadata,
};
var isUnauthenticateMessage = function (msg) {
return msg && msg.length === 2 && typeof(UNAUTHENTICATED_CALLS[msg[0]]) === 'function';
};
var handleUnauthenticatedMessage = function (Env, msg, respond, Server) {
var handleUnauthenticatedMessage = function (Env, msg, respond, Server, netfluxId) {
Env.Log.silly('LOG_RPC', msg[0]);
var method = UNAUTHENTICATED_CALLS[msg[0]];
@@ -37,7 +37,7 @@ var handleUnauthenticatedMessage = function (Env, msg, respond, Server) {
return void respond(err);
}
respond(err, [null, value, null]);
}, Server);
}, Server, netfluxId);
};
const AUTHENTICATED_USER_TARGETED = {
@@ -137,7 +137,7 @@ var rpc = function (Env, Server, userId, data, respond) {
}
if (isUnauthenticateMessage(msg)) {
return handleUnauthenticatedMessage(Env, msg, respond, Server);
return handleUnauthenticatedMessage(Env, msg, respond, Server, userId);
}
var signature = msg.shift();