From 3864c083a42e713e291bd954b2fa6fe2b85e930a Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Fri, 13 Sep 2013 14:44:57 +0200 Subject: [PATCH] ubus: deny requests with a "ubus_rpc_session" toplevel attribute to prevent injecting different SIDs --- ubus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ubus.c b/ubus.c index 3c11246..0d41c2d 100644 --- a/ubus.c +++ b/ubus.c @@ -250,8 +250,11 @@ static void uh_ubus_send_request(struct client *cl, json_object *obj, const char int ret, rem; blob_buf_init(&req, 0); - blobmsg_for_each_attr(cur, args, rem) + blobmsg_for_each_attr(cur, args, rem) { + if (!strcmp(blobmsg_name(cur), "ubus_rpc_session")) + return uh_ubus_json_error(cl, ERROR_PARAMS); blobmsg_add_blob(&req, cur); + } blobmsg_add_string(&req, "ubus_rpc_session", sid); -- 2.25.1