flo/nsupdate.info
1
0
Fork 0
Code Issues 1 Pull Requests 2 Packages Releases Activity

security fix: authenticating is not enough, hostname qs param (if given) also needs to match the username

Browse Source
This commit is contained in:
Thomas Waldmann 2013-11-10 07:57:40 +01:00
parent 24b687960e
commit 367bc70f56
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nsupdate/api/views.py
View File

@ -193,9 +193,15 @@ class NicUpdateView(View):
if not check_api_auth(username, password): if not check_api_auth(username, password):
logger.info('%s - received bad credentials, username: %s' % (hostname, username, )) logger.info('%s - received bad credentials, username: %s' % (hostname, username, ))
return basic_challenge("authenticate to update DNS", 'badauth') return basic_challenge("authenticate to update DNS", 'badauth')
logging.info("authenticated by update secret for host %s" % username)
if hostname is None: if hostname is None:
# as we use update_username == hostname, we can fall back to that: # as we use update_username == hostname, we can fall back to that:
hostname = username hostname = username
elif hostname != username:
# trying to update a hostname given in querystring that doesn't
# match the username, which is required for us!
# maybe this host is owned by same person, but we can't know.
return Response('nohost') # or 'badauth'?
ipaddr = request.GET.get('myip') ipaddr = request.GET.get('myip')
if ipaddr is None: if ipaddr is None:
ipaddr = request.META.get('REMOTE_ADDR') ipaddr = request.META.get('REMOTE_ADDR')
@ -232,6 +238,7 @@ class AuthorizedNicUpdateView(View):
if not check_session_auth(request.user, hostname): if not check_session_auth(request.user, hostname):
logger.info('%s - is not owned by user: %s' % (hostname, request.user.username, )) logger.info('%s - is not owned by user: %s' % (hostname, request.user.username, ))
return Response('nohost') return Response('nohost')
logging.info("authenticated by session as user %s, creator of host %s" % (request.user.username, hostname))
ipaddr = request.GET.get('myip') ipaddr = request.GET.get('myip')
if not ipaddr: if not ipaddr:
ipaddr = request.META.get('REMOTE_ADDR') ipaddr = request.META.get('REMOTE_ADDR')