ogb912/opensim
1
0
Fork 0
mirror of https://github.com/opensim/opensim.git synced 2026-08-01 06:06:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make private services forbid llHTTPRequest() calls by rejecting those that have the X-SecondLife-Shard header.

Browse Source 
If you need to enable this, set AllowHttpRequestIn = true in [Network] for all private services or individual [*Service] sections.
This commit is contained in:
Justin Clark-Casey (justincc)
2015-03-04 17:51:11 +00:00
parent 7d3bafd5ab
commit 3255335c42
8 changed files with 184 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
OpenSim/Framework/ServiceAuth/BasicHttpAuthentication.cs
View File

@@ -28,6 +28,7 @@
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Net;
using System.Reflection;
using Nini.Config;
@@ -82,24 +83,28 @@ namespace OpenSim.Framework.ServiceAuth
return false;
}
public bool Authenticate(NameValueCollection requestHeaders, AddHeaderDelegate d)
public bool Authenticate(NameValueCollection requestHeaders, AddHeaderDelegate d, out HttpStatusCode statusCode)
{
//m_log.DebugFormat("[HTTP BASIC AUTH]: Authenticate in {0}", remove_me);
if (requestHeaders != null)
// m_log.DebugFormat("[HTTP BASIC AUTH]: Authenticate in {0}", "BasicHttpAuthentication");
string value = requestHeaders.Get("Authorization");
if (value != null)
{
string value = requestHeaders.Get("Authorization");
if (value != null)
value = value.Trim();
if (value.StartsWith("Basic "))
{
value = value.Trim();
if (value.StartsWith("Basic "))
value = value.Replace("Basic ", string.Empty);
if (Authenticate(value))
{
value = value.Replace("Basic ", string.Empty);
if (Authenticate(value))
return true;
statusCode = HttpStatusCode.OK;
return true;
}
}
}
d("WWW-Authenticate", "Basic realm = \"Asset Server\"");
statusCode = HttpStatusCode.Unauthorized;
return false;
}
}