Mirrored_Repos/obs-websocket
1
0
Fork 0
mirror of https://github.com/Palakis/obs-websocket.git synced 2024-08-30 18:12:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security fix : don't broadcast messages to unauthenticated clients

Browse Source
This commit is contained in:
Stéphane Lepin 2016-11-27 17:40:57 +01:00
parent 5abcd18ba0
commit 554ab54690
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
WSRequestHandler.cpp
View File

@ -104,6 +104,10 @@ void WSRequestHandler::sendTextMessage(QString textMessage) {
_client->sendTextMessage(textMessage); _client->sendTextMessage(textMessage);
} }
bool WSRequestHandler::isAuthenticated() {
return _authenticated;
}
WSRequestHandler::~WSRequestHandler() { WSRequestHandler::~WSRequestHandler() {
if (_requestData != NULL) { if (_requestData != NULL) {
obs_data_release(_requestData); obs_data_release(_requestData);
@ -140,7 +144,7 @@ void WSRequestHandler::HandleGetVersion(WSRequestHandler *owner) {
obs_data_set_double(data, "version", 1.1); obs_data_set_double(data, "version", 1.1);
obs_data_set_string(data, "obs-websocket-version", OBS_WEBSOCKET_VERSION); obs_data_set_string(data, "obs-websocket-version", OBS_WEBSOCKET_VERSION);
//obs_data_set_string(data, "obs-studio-version", OBS_VERSION); // Wrong //obs_data_set_string(data, "obs-studio-version", OBS_VERSION); // Wrong
owner->SendOKResponse(data); owner->SendOKResponse(data);
obs_data_release(data); obs_data_release(data);

1
WSRequestHandler.h
View File

@ -32,6 +32,7 @@ class WSRequestHandler : public QObject
explicit WSRequestHandler(QWebSocket *client); explicit WSRequestHandler(QWebSocket *client);
~WSRequestHandler(); ~WSRequestHandler();
void sendTextMessage(QString textMessage); void sendTextMessage(QString textMessage);
bool isAuthenticated();
private Q_SLOTS: private Q_SLOTS:
void processTextMessage(QString textMessage); void processTextMessage(QString textMessage);

7
WSServer.cpp
View File

@ -18,6 +18,7 @@ with this program. If not, see <https://www.gnu.org/licenses/>
#include "WSServer.h" #include "WSServer.h"
#include "WSRequestHandler.h" #include "WSRequestHandler.h"
#include "Config.h"
#include <QtWebSockets/QWebSocketServer> #include <QtWebSockets/QWebSocketServer>
#include <QtWebSockets/QWebSocket> #include <QtWebSockets/QWebSocket>
#include <QtCore/QDebug> #include <QtCore/QDebug>
@ -54,6 +55,12 @@ WSServer::~WSServer()
void WSServer::broadcast(QString message) void WSServer::broadcast(QString message)
{ {
Q_FOREACH(WSRequestHandler *pClient, _clients) { Q_FOREACH(WSRequestHandler *pClient, _clients) {
if (Config::Current()->AuthRequired == true
&& pClient->isAuthenticated() == false) {
// Skip this client if unauthenticated
continue;
}
pClient->sendTextMessage(message); pClient->sendTextMessage(message);
} }
} }