From 3ae91b65365d119d0121db5c2e26fd32c1204a19 Mon Sep 17 00:00:00 2001
From: xirvik <community@xirvik.net>
Date: Mon, 17 Aug 2026 15:24:44 +0000
Subject: [PATCH] Check flag_public_rpc when dispatching jsonrpc calls.

Private commands and non-exported redirects were reachable over jsonrpc.
---
 src/rpc/jsonrpc.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rpc/jsonrpc.cc b/src/rpc/jsonrpc.cc
index 395b5999..611c35aa 100644
--- a/src/rpc/jsonrpc.cc
+++ b/src/rpc/jsonrpc.cc
@@ -146,7 +146,7 @@ jsonrpc_call_command(const std::string& method, const json& params) {
 
   CommandMap::iterator itr = commands.find(method.c_str());
 
-  if (itr == commands.end()) {
+  if (itr == commands.end() || !(itr->second.m_flags & CommandMap::flag_public_rpc)) {
     throw rpc_error(JSONRPC_METHOD_NOT_FOUND_ERROR, "method not found: " + method);
   }