phantom/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2025-01-25 02:32:58 -03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Adds username validation for socketio event handler as well

Browse source
This commit is contained in:
Saptak S 2021-11-14 23:28:17 +05:30
parent 2a7c3d6867
commit 6429392a40
No known key found for this signature in database
GPG key ID: 7B7F1772C0C6FCBF
2 changed files with 28 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
cli/onionshare_cli/resources/static/js/chat.js
View file

@ -93,6 +93,8 @@ var updateUsername = function (socket) {
console.log(response); console.log(response);
if (response.success && response.username == username) { if (response.success && response.username == username) {
socket.emit('update_username', { username: username }); socket.emit('update_username', { username: username });
} else {
addStatusMessage("Failed to updated username.")
} }
}); });
return username; return username;

44
cli/onionshare_cli/web/chat_mode.py
View file

@ -47,6 +47,13 @@ class ChatModeWeb:
self.define_routes() self.define_routes()
def validate_username(self, username):
return (
username
and username not in self.connected_users
and len(username) < 128
)
def define_routes(self): def define_routes(self):
""" """
The web app routes for chatting The web app routes for chatting
@ -78,11 +85,7 @@ class ChatModeWeb:
def update_session_username(): def update_session_username():
history_id = self.cur_history_id history_id = self.cur_history_id
data = request.get_json() data = request.get_json()
if ( if self.validate_username(data.get("username", "")):
data.get("username", "")
and data.get("username", "") not in self.connected_users
and len(data.get("username", "")) < 128
):
session["name"] = data.get("username", session.get("name")) session["name"] = data.get("username", session.get("name"))
self.web.add_request( self.web.add_request(
request.path, request.path,
@ -141,23 +144,28 @@ class ChatModeWeb:
"""Sent by a client when the user updates their username. """Sent by a client when the user updates their username.
The message is sent to all people in the server.""" The message is sent to all people in the server."""
current_name = session.get("name") current_name = session.get("name")
if message.get("username", ""): if self.validate_username(message.get("username", "")):
session["name"] = message["username"] session["name"] = message["username"]
self.connected_users[ self.connected_users[
self.connected_users.index(current_name) self.connected_users.index(current_name)
] = session.get("name") ] = session.get("name")
emit( emit(
"status", "status",
{ {
"msg": "{} has updated their username to: {}".format( "msg": "{} has updated their username to: {}".format(
current_name, session.get("name") current_name, session.get("name")
), ),
"connected_users": self.connected_users, "connected_users": self.connected_users,
"old_name": current_name, "old_name": current_name,
"new_name": session.get("name"), "new_name": session.get("name"),
}, },
broadcast=True, broadcast=True,
) )
else:
emit(
"status",
{"msg": "Failed to update username."},
)
@self.web.socketio.on("disconnect", namespace="/chat") @self.web.socketio.on("disconnect", namespace="/chat")
def disconnect(): def disconnect():