grassrootseconomics/openethereum
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixing origin/host validation (#1273)

Browse Source
This commit is contained in:
Tomasz Drwięga
2016-06-15 00:57:49 +02:00
committed by Gav Wood
parent f7536876d5
commit b562480173
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
signer/src/ws_server/session.rs
View File

@@ -75,7 +75,7 @@ impl ws::Handler for Session {
let host = req.header("host").or_else(|| req.header("Host"));
// Check request origin and host header.
if !origin_is_allowed(&self.self_origin, origin) && !origin_is_allowed(&self.self_origin, host) {
if !origin_is_allowed(&self.self_origin, origin) && !(origin.is_none() && origin_is_allowed(&self.self_origin, host)) {
warn!(target: "signer", "Blocked connection to Signer API from untrusted origin.");
return Ok(ws::Response::forbidden(format!("You are not allowed to access system ui. Use: http://{}", self.self_origin)));
}