mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
4f7bca9754
Engine.IO accepts a connection, and holds one of socketiod's 40 threads for it, from its first request; the console token is checked only in Socket.IO's connect(), which a client need never send. Anyone who could reach the panel, without an account, could open 40 websockets, answer their pings, and no serial console would open for anybody (checked: the 41st handshake got no answer until they were closed). The daemon's WSGI app now refuses a request whose session cookie names no signed-in user, with 403, before Engine.IO sees it; the page always sends that cookie. A token without its session no longer connects either, as for novncd. Checked again: 60 such websockets are each answered 403 at once and hold nothing. The process tests sign their client in with a session cookie, as a browser; python-socketio sends a custom Cookie header only with its first request, so the client gets a cookie jar instead. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| daemons.py | ||
| test_consolecallback.py | ||
| test_layouts.py | ||
| test_live_serial.py | ||
| test_novncd.py | ||
| test_socketiod.py | ||
| test_socketiod_child.py | ||
| test_sshtunnels.py | ||
| test_views.py | ||