ogb912/opensim
1
0
Fork 0
mirror of https://github.com/opensim/opensim.git synced 2026-08-12 12:25:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

thanks lulurun for a security patch that blocks unathorized access to the inventory server (see http://opensimulator.org/wiki/Security_vulnerability_brought_by_non-check_inventory_service)

Browse Source
This commit is contained in:
Johan Berntsson
2008-07-23 06:59:02 +00:00
parent f9e2f41d7c
commit 344c9caeb6
10 changed files with 156 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
OpenSim/Grid/UserServer/Main.cs
View File

@@ -142,6 +142,7 @@ namespace OpenSim.Grid.UserServer
m_httpServer.AddXmlRPCHandler("update_user_current_region", m_userManager.XmlRPCAtRegion);
m_httpServer.AddXmlRPCHandler("logout_of_simulator", m_userManager.XmlRPCLogOffUserMethodUUID);
m_httpServer.AddXmlRPCHandler("get_agent_by_uuid", m_userManager.XmlRPCGetAgentMethodUUID);
m_httpServer.AddXmlRPCHandler("check_auth_session", m_userManager.XmlRPCCheckAuthSession);
// Message Server ---> User Server
m_httpServer.AddXmlRPCHandler("register_messageserver", m_messagesService.XmlRPCRegisterMessageServer);
m_httpServer.AddXmlRPCHandler("agent_change_region", m_messagesService.XmlRPCUserMovedtoRegion);

39
OpenSim/Grid/UserServer/UserManager.cs
View File

@@ -457,6 +457,45 @@ namespace OpenSim.Grid.UserServer
return response;
}
public XmlRpcResponse XmlRPCCheckAuthSession(XmlRpcRequest request)
{
XmlRpcResponse response = new XmlRpcResponse();
Hashtable requestData = (Hashtable)request.Params[0];
UserProfileData userProfile;
string authed = "FALSE";
if (requestData.Contains("avatar_uuid") && requestData.Contains("session_id"))
{
LLUUID guess_aid = LLUUID.Zero;
LLUUID guess_sid = LLUUID.Zero;
Helpers.TryParse((string)requestData["avatar_uuid"], out guess_aid);
if (guess_aid == LLUUID.Zero)
{
return CreateUnknownUserErrorResponse();
}
Helpers.TryParse((string)requestData["session_id"], out guess_sid);
if (guess_sid == LLUUID.Zero)
{
return CreateUnknownUserErrorResponse();
}
userProfile = GetUserProfile(guess_aid);
if (userProfile != null && userProfile.CurrentAgent != null && userProfile.CurrentAgent.SessionID == guess_sid)
{
authed = "TRUE";
}
m_log.InfoFormat("[UserManager]: CheckAuthSession TRUE for user {0}", guess_aid);
}
else
{
m_log.InfoFormat("[UserManager]: CheckAuthSession FALSE");
return CreateUnknownUserErrorResponse();
}
Hashtable responseData = new Hashtable();
responseData["auth_session"] = authed;
response.Value = responseData;
return response;
}
public XmlRpcResponse XmlRpcResponseXmlRPCUpdateUserProfile(XmlRpcRequest request)
{