Merge pull request #34 from zsichen/dev

Check session id before accepting request

client.go

@@ -1,12 +1,13 @@
 package main
 
 import (
-	"github.com/gorilla/websocket"
-	log "github.com/sirupsen/logrus"
 	"net/http"
 	"strconv"
 	"sync"
 	"time"
+
+	"github.com/gorilla/websocket"
+	log "github.com/sirupsen/logrus"
 )
 
 var upgrader = websocket.Upgrader{
@@ -73,6 +74,10 @@ func serveWs(br *Broker, w http.ResponseWriter, r *http.Request, cfg *RttysConfi
 			http.Error(w, "Forbidden", http.StatusForbidden)
 			return
 		}
+	} else if _, ok := httpSessions.Get(r.URL.Query().Get("sid")); !ok {
+		log.Error("Invalid sid from client")
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
 	}
 
 	keepalive, _ := strconv.Atoi(r.URL.Query().Get("keepalive"))

command.go

@@ -2,14 +2,15 @@ package main
 
 import (
 	"fmt"
-	jsoniter "github.com/json-iterator/go"
-	log "github.com/sirupsen/logrus"
 	"io"
 	"io/ioutil"
 	"net/http"
 	"sync"
 	"time"
 
+	jsoniter "github.com/json-iterator/go"
+	log "github.com/sirupsen/logrus"
+
 	"github.com/gorilla/websocket"
 )
 
@@ -38,8 +39,11 @@ type commandStatus struct {
 }
 
 type CommandInfo struct {
-	Devid string `json:"devid"`
-	Cmd   string `json:"cmd"`
+	Devid    string `json:"devid"`
+	Cmd      string `json:"cmd"`
+	Sid      string `json:"sid"`
+	Username string `json:"username"`
+	Password string `json:"password"`
 }
 
 var commands sync.Map
@@ -85,7 +89,7 @@ func serveCmd(br *Broker, w http.ResponseWriter, r *http.Request) {
 
 	cmdInfo := CommandInfo{}
 	err = jsoniter.Unmarshal(body, &cmdInfo)
-	if err != nil || cmdInfo.Cmd == "" || cmdInfo.Devid == "" {
+	if _, ok := httpSessions.Get(cmdInfo.Sid); err != nil || cmdInfo.Cmd == "" || cmdInfo.Devid == "" || ok == false {
 		cmdErrReply(RTTY_CMD_ERR_INVALID, w)
 		return
 	}

html/package-lock.json

@@ -2698,8 +2698,7 @@
       "version": "4.6.0",
       "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
       "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
-      "dev": true,
-      "optional": true
+      "dev": true
     },
     "coa": {
       "version": "2.0.2",
@@ -6604,7 +6603,6 @@
       "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",
       "integrity": "sha1-OwmSTt+fCDwEkP3UwLxEIeBHZO4=",
       "dev": true,
-      "optional": true,
       "requires": {
         "prelude-ls": "~1.1.2",
         "type-check": "~0.3.2"
@@ -8426,8 +8424,7 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz",
       "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=",
-      "dev": true,
-      "optional": true
+      "dev": true
     },
     "prepend-http": {
       "version": "2.0.0",
@@ -9057,8 +9054,7 @@
       "version": "4.0.8",
       "resolved": "https://registry.npmjs.org/rx-lite/-/rx-lite-4.0.8.tgz",
       "integrity": "sha1-Cx4Rr4vESDbwSmQH6S2kJGe3lEQ=",
-      "dev": true,
-      "optional": true
+      "dev": true
     },
     "rx-lite-aggregates": {
       "version": "4.0.8",
@@ -10278,7 +10274,6 @@
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz",
       "integrity": "sha1-WITKtRLPHTVeP7eE8wgEsrUg23I=",
       "dev": true,
-      "optional": true,
       "requires": {
         "prelude-ls": "~1.1.2"
       }

html/src/views/Home.vue

@@ -282,6 +282,7 @@ export default {
                             devid: item.id,
                             username: this.cmdData.username,
                             password: this.cmdData.password,
+                            sid: sessionStorage.getItem('rtty-sid'),
                             cmd: this.cmdData.cmd.trim(),
                             params: this.cmdData.params,
                             env: this.cmdData.env

html/src/views/Login.vue

@@ -43,7 +43,7 @@ export default {
                         password: this.form.password
                     };
                     this.$axios.post(process.env.BASE_URL + 'signin', params).then(res => {
-                        sessionStorage.setItem('rtty-sid', res);
+                        sessionStorage.setItem('rtty-sid', res.data);
                         this.$router.push('/');
                     }).catch(() => {
                         this.$Message.error(this.$t('Signin Fail! username or password wrong.'));

html/src/views/Rtty.vue

@@ -82,7 +82,7 @@ export default {
         this.username = this.$route.query.username;
         this.password = this.$route.query.password;
 
-        let ws = new WebSocket(protocol + location.host + process.env.BASE_URL + 'ws?devid=' + devid);
+        let ws = new WebSocket(protocol + location.host + process.env.BASE_URL + 'ws?devid=' + devid + '&sid=' + sessionStorage.getItem('rtty-sid'));
 
         ws.onopen = () => {
             ws.binaryType = 'arraybuffer';