mirror/galene
1
Fork 0
mirror of https://github.com/jech/galene.git synced 2024-11-10 02:35:58 +01:00
Code Activity

More spoofing protection.

Browse source
This commit is contained in:
Juliusz Chroboczek 2020-11-30 15:39:44 +01:00
parent aa71205fa2
commit ed531cefc2
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
rtpconn/webclient.go
View file

@ -1114,6 +1114,12 @@ func handleClientMessage(c *webClient, m clientMessage) error {
ccc.write(mm) ccc.write(mm)
} }
case "groupaction": case "groupaction":
if m.Id != c.id {
return group.UserError("wrong sender id")
}
if m.Username != "" && m.Username != c.username {
return group.UserError("wrong sender username")
}
switch m.Kind { switch m.Kind {
case "clearchat": case "clearchat":
c.group.ClearChatHistory() c.group.ClearChatHistory()
@ -1162,6 +1168,12 @@ func handleClientMessage(c *webClient, m clientMessage) error {
return group.ProtocolError("unknown group action") return group.ProtocolError("unknown group action")
} }
case "useraction": case "useraction":
if m.Id != c.id {
return group.UserError("wrong sender id")
}
if m.Username != "" && m.Username != c.username {
return group.UserError("wrong sender username")
}
switch m.Kind { switch m.Kind {
case "op", "unop", "present", "unpresent": case "op", "unop", "present", "unpresent":
if !c.permissions.Op { if !c.permissions.Op {