From c30b0b72b85b3adc5fb00c5d082ab05c3d2c1efc Mon Sep 17 00:00:00 2001 From: Marcel Klehr Date: Wed, 13 Mar 2013 22:23:35 +0100 Subject: [PATCH] Validate all 'author' attribs of incoming changesets to be the same value as the current user's authorId --- src/node/handler/PadMessageHandler.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/node/handler/PadMessageHandler.js b/src/node/handler/PadMessageHandler.js index c046f130..35f1ab4c 100644 --- a/src/node/handler/PadMessageHandler.js +++ b/src/node/handler/PadMessageHandler.js @@ -550,11 +550,16 @@ function handleUserChanges(client, message) throw "Attribute pool is missing attribute "+n+" for changeset "+changeset; } }); + + // Validate all 'author' attribs to be the same value as the current user + wireApool.eachAttrib(function(type, value) { + if('author' == type && value != thisSession.author) throw "Trying to submit changes as another author" + }) } catch(e) { // There is an error in this changeset, so just refuse it - console.warn("Can't apply USER_CHANGES "+changeset+", because it failed checkRep"); + console.warn("Can't apply USER_CHANGES "+changeset+", because: "+e); client.json.send({disconnect:"badChangeset"}); return; }