LBRYFoundation/LBRY-Vault
1
0
Fork 0
mirror of https://github.com/LBRYFoundation/LBRY-Vault.git synced 2025-09-01 17:55:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

backport security updates: disable CORS and JSONRPC in gui

Browse source
This commit is contained in:
ThomasV 2018-01-12 15:10:59 +01:00
parent 24e3fab8af
commit af0715e476
2 changed files with 17 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
electrum
View file

@ -372,7 +372,7 @@ if __name__ == '__main__':
fd, server = daemon.get_fd_or_server(config) fd, server = daemon.get_fd_or_server(config)
if fd is not None: if fd is not None:
plugins = init_plugins(config, config.get('gui', 'qt')) plugins = init_plugins(config, config.get('gui', 'qt'))
d = daemon.Daemon(config, fd) d = daemon.Daemon(config, fd, True)
d.start() d.start()
d.init_gui(config, plugins) d.init_gui(config, plugins)
sys.exit(0) sys.exit(0)
@ -393,7 +393,7 @@ if __name__ == '__main__':
print_stderr("starting daemon (PID %d)" % pid) print_stderr("starting daemon (PID %d)" % pid)
sys.exit(0) sys.exit(0)
init_plugins(config, 'cmdline') init_plugins(config, 'cmdline')
d = daemon.Daemon(config, fd) d = daemon.Daemon(config, fd, False)
d.start() d.start()
if config.get('websocket_server'): if config.get('websocket_server'):
from electrum import websockets from electrum import websockets

43
lib/daemon.py
View file

@ -29,7 +29,7 @@ import sys
import time import time
import jsonrpclib import jsonrpclib
from jsonrpclib.SimpleJSONRPCServer import SimpleJSONRPCServer, SimpleJSONRPCRequestHandler from jsonrpclib.SimpleJSONRPCServer import SimpleJSONRPCServer
from version import ELECTRUM_VERSION from version import ELECTRUM_VERSION
from network import Network from network import Network
@ -85,23 +85,9 @@ def get_server(config):
time.sleep(1.0) time.sleep(1.0)
class RequestHandler(SimpleJSONRPCRequestHandler):
def do_OPTIONS(self):
self.send_response(200)
self.end_headers()
def end_headers(self):
self.send_header("Access-Control-Allow-Headers",
"Origin, X-Requested-With, Content-Type, Accept")
self.send_header("Access-Control-Allow-Origin", "*")
SimpleJSONRPCRequestHandler.end_headers(self)
class Daemon(DaemonThread): class Daemon(DaemonThread):
def __init__(self, config, fd): def __init__(self, config, fd, is_gui):
DaemonThread.__init__(self) DaemonThread.__init__(self)
self.config = config self.config = config
if config.get('offline'): if config.get('offline'):
@ -116,15 +102,13 @@ class Daemon(DaemonThread):
self.gui = None self.gui = None
self.wallets = {} self.wallets = {}
# Setup JSONRPC server # Setup JSONRPC server
self.cmd_runner = Commands(self.config, None, self.network) self.init_server(config, fd, is_gui)
self.init_server(config, fd)
def init_server(self, config, fd): def init_server(self, config, fd, is_gui):
host = config.get('rpchost', '127.0.0.1') host = config.get('rpchost', '127.0.0.1')
port = config.get('rpcport', 0) port = config.get('rpcport', 0)
try: try:
server = SimpleJSONRPCServer((host, port), logRequests=False, server = SimpleJSONRPCServer((host, port), logRequests=False)
requestHandler=RequestHandler)
except: except:
self.print_error('Warning: cannot initialize RPC server on host', host) self.print_error('Warning: cannot initialize RPC server on host', host)
self.server = None self.server = None
@ -132,14 +116,17 @@ class Daemon(DaemonThread):
return return
os.write(fd, repr((server.socket.getsockname(), time.time()))) os.write(fd, repr((server.socket.getsockname(), time.time())))
os.close(fd) os.close(fd)
server.timeout = 0.1
for cmdname in known_commands:
server.register_function(getattr(self.cmd_runner, cmdname), cmdname)
server.register_function(self.run_cmdline, 'run_cmdline')
server.register_function(self.ping, 'ping')
server.register_function(self.run_daemon, 'daemon')
server.register_function(self.run_gui, 'gui')
self.server = server self.server = server
server.timeout = 0.1
server.register_function(self.ping, 'ping')
if is_gui:
server.register_function(self.run_gui, 'gui')
else:
self.cmd_runner = Commands(self.config, None, self.network)
for cmdname in known_commands:
server.register_function(getattr(self.cmd_runner, cmdname), cmdname)
server.register_function(self.run_cmdline, 'run_cmdline')
server.register_function(self.run_daemon, 'daemon')
def ping(self): def ping(self):
return True return True