ogb912/opensim
1
0
Fork 0
mirror of https://github.com/opensim/opensim.git synced 2026-08-05 00:46:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make private services forbid llHTTPRequest() calls by rejecting those that have the X-SecondLife-Shard header.

Browse Source 
If you need to enable this, set AllowHttpRequestIn = true in [Network] for all private services or individual [*Service] sections.
This commit is contained in:
Justin Clark-Casey (justincc)
2015-03-04 17:51:11 +00:00
parent 7d3bafd5ab
commit 3255335c42
8 changed files with 184 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
OpenSim/Framework/Servers/HttpServer/BaseStreamHandler.cs
View File

@@ -56,12 +56,17 @@ namespace OpenSim.Framework.Servers.HttpServer
string path, Stream request, IOSHttpRequest httpRequest, IOSHttpResponse httpResponse)
{
RequestsReceived++;
if (m_Auth != null && !m_Auth.Authenticate(httpRequest.Headers, httpResponse.AddHeader))
if (m_Auth != null)
{
httpResponse.StatusCode = (int)HttpStatusCode.Unauthorized;
httpResponse.ContentType = "text/plain";
return new byte[0];
HttpStatusCode statusCode;
if (!m_Auth.Authenticate(httpRequest.Headers, httpResponse.AddHeader, out statusCode))
{
httpResponse.StatusCode = (int)statusCode;
httpResponse.ContentType = "text/plain";
return new byte[0];
}
}
byte[] result = ProcessRequest(path, request, httpRequest, httpResponse);