mirror of
https://github.com/SoftEtherVPN/SoftEtherVPN.git
synced 2024-11-22 17:39:53 +03:00
Fix security issue: Fix the security of JSON-API. If the administrator password of the Virtual Hub is empty, JSON-API (which was added in 4.30 Build 9696 Beta) will not be able to access to the virtual hub with a empty password since this release. Because there are relatively many cases in which administrator password is empty for a virtual hub, being able to manage a virtual hub without a password using JSON-API was a security problem. In this release, this behavior has been changed so that JSON-API cannot be accessed in the Virtual Hub management mode until it is configured with non-empty password.
This commit is contained in:
parent
c6f186bd73
commit
033647c8ac
@ -1017,6 +1017,8 @@ ADMIN *JsonRpcAuthLogin(CEDAR *c, SOCK *sock, HTTP_HEADER *h)
|
||||
if (h != NULL)
|
||||
{
|
||||
Lock(h->lock);
|
||||
{
|
||||
if (Cmp(h->HashedPassword, empty_pw_hash, SHA1_SIZE) != 0 && IsZero(h->HashedPassword, sizeof(h->HashedPassword)) == false)
|
||||
{
|
||||
if (Cmp(pw_hash, h->HashedPassword, SHA1_SIZE) == 0)
|
||||
{
|
||||
@ -1025,6 +1027,7 @@ ADMIN *JsonRpcAuthLogin(CEDAR *c, SOCK *sock, HTTP_HEADER *h)
|
||||
StrCpy(hub_name, sizeof(hub_name), h->Name);
|
||||
}
|
||||
}
|
||||
}
|
||||
Unlock(h->lock);
|
||||
|
||||
ReleaseHub(h);
|
||||
|
Loading…
Reference in New Issue
Block a user