octoleo/syncthing
1
0
Fork 0
mirror of https://github.com/octoleo/syncthing.git synced 2024-12-31 14:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

API key change should take effect on restart only

Browse Source
This commit is contained in:
Jakob Borg 2014-06-05 09:16:12 +02:00
parent 20a018db2e
commit 1cff9ccc63
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/syncthing/gui.go
View File

@ -40,6 +40,7 @@ var (
guiErrors = []guiError{}
guiErrorsMut sync.Mutex
static func(http.ResponseWriter, *http.Request, *log.Logger)
apiKey string
)
const (
@ -115,6 +116,7 @@ func startGUI(cfg config.GUIConfiguration, assetDir string, m *model.Model) erro
mr.Action(router.Handle)
mr.Map(m)
apiKey = cfg.APIKey
loadCsrfTokens()
go http.Serve(listener, mr)
@ -363,7 +365,7 @@ func basic(username string, passhash string) http.HandlerFunc {
}
func validAPIKey(k string) bool {
return len(cfg.GUI.APIKey) > 0 && k == cfg.GUI.APIKey
return len(apiKey) > 0 && k == apiKey
}
func embeddedStatic() func(http.ResponseWriter, *http.Request, *log.Logger) {

1
cmd/syncthing/gui_csrf.go
View File

@ -25,6 +25,7 @@ func csrfMiddleware(w http.ResponseWriter, r *http.Request) {
if validAPIKey(r.Header.Get("X-API-Key")) {
return
}
if strings.HasPrefix(r.URL.Path, "/rest/") {
token := r.Header.Get("X-CSRF-Token")
if !validCsrfToken(token) {