fujin/rtorrent
1
0
Fork 0
mirror of https://github.com/rakshasa/rtorrent.git synced 2026-08-15 22:52:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address review feedback: explicit mark_safe whitelist and rpc trust flow

Browse Source
This commit is contained in:
Xirvik
2026-03-03 04:32:54 +00:00
committed by Jari Sundell
parent ba239bc8c5
commit d935e0ffe9
17 changed files with 807 additions and 560 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/rpc/rpc_manager.h
+8 -10
View File
@@ -4,6 +4,7 @@
#include <cstdint>
#include <functional>
#include <torrent/common.h>
#include <torrent/exceptions.h>
#include "rpc/command.h"
#include "rpc/command_map.h"
@@ -34,15 +35,10 @@ private:
std::string m_msg;
};
class untrusted_error : public torrent::base_error {
class untrusted_error : public torrent::input_error {
public:
untrusted_error(std::string msg) : m_msg(std::move(msg)) {}
using torrent::input_error::input_error;
virtual ~untrusted_error() throw() = default;
virtual const char* what() const throw() { return m_msg.c_str(); }
private:
std::string m_msg;
};
class RpcManager {
@@ -74,8 +70,10 @@ public:
void set_type_enabled(RPCType type, bool enabled);
bool process(RPCType type, const char* in_buffer, uint32_t length, slot_response_callback callback);
bool process_untrusted(RPCType type, const char* in_buffer, uint32_t length, slot_response_callback callback);
void insert_command(const char* name, const char* parm, const char* doc);
void mark_safe(const std::string& key);
slot_download& slot_find_download() { return m_slot_find_download; }
slot_file& slot_find_file() { return m_slot_find_file; }
@@ -85,13 +83,13 @@ public:
// Trusted/untrusted XMLRPC connection model.
// When an SCGI request includes the UNTRUSTED_CONNECTION header,
// commands without flag_untrusted_safe are blocked.
static bool set_trusted(bool trusted);
static bool is_trusted();
bool set_trusted(bool trusted);
bool is_trusted() const;
static void object_to_target(const torrent::Object& obj, int callFlags, rpc::target_type* target, std::function<void()>* deleter);
private:
static thread_local bool m_trusted;
bool m_trusted{true};
XmlRpc m_xmlrpc;
JsonRpc m_jsonrpc;