diff options
| author | Robert Adam <dev@robert-adam.de> | 2021-03-03 09:35:22 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-03 09:35:22 +0300 |
| commit | 6657a6f2a1dc84cc82f1157073727ae1103c79c7 (patch) | |
| tree | 66d486868d3f9a3de33461d19b6e5e88faa5ac15 | |
| parent | cdbc4058874f623b7b5404a6502cf2bc426abbb6 (diff) | |
| parent | eabfbab403e6ba10219c262518899db5a60d0c1e (diff) | |
Merge pull request #4817: FIX(Server): Unauthenticated connections no longer add to user count
This commit fixes both issues discussed in #4277 which were related to
the fact that any socket connection was allocated an ID and marked as
a user. This bug allowed for a malicious user to lock out all users of
a server regardless of server password usage. This change simply moves ID
allocation to after a connection is marked as Authenticated.
FIXES: #4277
| -rw-r--r-- | src/murmur/Messages.cpp | 3 | ||||
| -rw-r--r-- | src/murmur/Server.cpp | 7 |
2 files changed, 3 insertions, 7 deletions
diff --git a/src/murmur/Messages.cpp b/src/murmur/Messages.cpp index 9e94fc37f..94adc2c71 100644 --- a/src/murmur/Messages.cpp +++ b/src/murmur/Messages.cpp @@ -379,7 +379,10 @@ void Server::msgAuthenticate(ServerUser *uSource, MumbleProto::Authenticate &msg { QWriteLocker wl(&qrwlVoiceThread); + uSource->uiSession = qqIds.dequeue(); uSource->sState = ServerUser::Authenticated; + qhUsers.insert(uSource->uiSession, uSource); + qhHostUsers[uSource->haAddress].insert(uSource); } mpus.set_session(uSource->uiSession); diff --git a/src/murmur/Server.cpp b/src/murmur/Server.cpp index 7745a9867..3f879f682 100644 --- a/src/murmur/Server.cpp +++ b/src/murmur/Server.cpp @@ -1450,16 +1450,9 @@ void Server::newClient() { } ServerUser *u = new ServerUser(this, sock); - u->uiSession = qqIds.dequeue(); u->haAddress = ha; HostAddress(sock->localAddress()).toSockaddr(&u->saiTcpLocalAddress); - { - QWriteLocker wl(&qrwlVoiceThread); - qhUsers.insert(u->uiSession, u); - qhHostUsers[ha].insert(u); - } - connect(u, SIGNAL(connectionClosed(QAbstractSocket::SocketError, const QString &)), this, SLOT(connectionClosed(QAbstractSocket::SocketError, const QString &))); connect(u, SIGNAL(message(unsigned int, const QByteArray &)), this, |