xle/tt-rss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

check if client-presented URL scheme is different from one configured in SELF_URL_PATH

Browse Source
This commit is contained in:
Andrew Dolgov
2021-02-26 14:14:44 +03:00
parent 4896874bda
commit e6a875b7e4
3 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
classes/errors.php
View File

@@ -5,8 +5,9 @@ class Errors {
const E_UNKNOWN_METHOD = "E_UNKNOWN_METHOD";
const E_UNKNOWN_PLUGIN = "E_UNKNOWN_PLUGIN";
const E_SCHEMA_MISMATCH = "E_SCHEMA_MISMATCH";
const E_URL_SCHEME_MISMATCH = "E_URL_SCHEME_MISMATCH";
static function to_json(string $code) {
return json_encode(["error" => ["code" => $code]]);
static function to_json(string $code, array $params = []) {
return json_encode(["error" => ["code" => $code, "params" => $params]]);
}
}

13
classes/rpc.php
View File

@@ -168,10 +168,21 @@ class RPC extends Handler_Protected {
$_SESSION["hasSandbox"] = clean($_REQUEST["hasSandbox"]) === "true";
$_SESSION["clientTzOffset"] = clean($_REQUEST["clientTzOffset"]);
$client_location = $_REQUEST["clientLocation"];
$error = Errors::E_SUCCESS;
$error_params = [];
$client_scheme = parse_url($client_location, PHP_URL_SCHEME);
$server_scheme = parse_url(get_self_url_prefix(), PHP_URL_SCHEME);
if (get_schema_version() != SCHEMA_VERSION) {
$error = Errors::E_SCHEMA_MISMATCH;
} else if ($client_scheme != $server_scheme) {
$error = Errors::E_URL_SCHEME_MISMATCH;
$error_params["client_scheme"] = $client_scheme;
$error_params["server_scheme"] = $server_scheme;
$error_params["self_url_path"] = get_self_url_prefix();
}
if ($error == Errors::E_SUCCESS) {
@@ -183,7 +194,7 @@ class RPC extends Handler_Protected {
print json_encode($reply);
} else {
print Errors::to_json($error);
print Errors::to_json($error, $error_params);
}
}