zefie/minisrv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re-write security system to be more like WNI

Browse Source 
- can get telly and reach stage-two
- narrow whitelist of allowed URLS in WTVClientSessionData constructor
- enough to show wtv-1800:/unauthorized with trust priv
- Times out lockeddown users really fast ;)
- untested disk error page
This commit is contained in:
zefie
2021-11-12 15:35:40 -05:00
parent 2f51c3e7b5
commit 3da57455eb
12 changed files with 352 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
zefie_wtvp_minisrv/ServiceVault/wtv-1800/preregister.js
View File

@@ -162,8 +162,8 @@ if (ssid_sessions[socket.ssid].data_store.wtvsec_login) {
if (bf0app_update) headers += getServiceString('wtv-star', { "no_star_word": true }) + "\n";
else headers += getServiceString('wtv-star') + "\n";
if (request_headers.query.reconnect && !ssid_sessions[socket.ssid].getSessionData("registered")) headers += getServiceString('wtv-register') + "\n";
headers += getServiceString('wtv-flashrom') + "\n";
if (request_headers.query.reconnect && !ssid_sessions[socket.ssid].getSessionData("registered") && !ssid_sessions[socket.ssid].lockdown) headers += getServiceString('wtv-register') + "\n";
if (!ssid_sessions[socket.ssid].lockdown) headers += getServiceString('wtv-flashrom') + "\n";
if (bf0app_update) headers += "wtv-boot-url: " + gourl + "\n";
else {
headers += "wtv-boot-url: wtv-head-waiter:/relogin?relogin=true";