Skip to content

Commit e7156ad

Browse files
committed
[RPC] pass HTTP basic authentication username to the JSONRequest object
1 parent 69d1c25 commit e7156ad

File tree

3 files changed

+10
-5
lines changed

3 files changed

+10
-5
lines changed

src/httprpc.cpp

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ static bool multiUserAuthorized(std::string strUserPass)
127127
return false;
128128
}
129129

130-
static bool RPCAuthorized(const std::string& strAuth)
130+
static bool RPCAuthorized(const std::string& strAuth, std::string& strAuthUsernameOut)
131131
{
132132
if (strRPCUserColonPass.empty()) // Belt-and-suspenders measure if InitRPCAuthentication was not called
133133
return false;
@@ -136,7 +136,10 @@ static bool RPCAuthorized(const std::string& strAuth)
136136
std::string strUserPass64 = strAuth.substr(6);
137137
boost::trim(strUserPass64);
138138
std::string strUserPass = DecodeBase64(strUserPass64);
139-
139+
140+
if (strUserPass.find(":") != std::string::npos)
141+
strAuthUsernameOut = strUserPass.substr(0, strUserPass.find(":"));
142+
140143
//Check if authorized under single-user field
141144
if (TimingResistantEqual(strUserPass, strRPCUserColonPass)) {
142145
return true;
@@ -159,7 +162,8 @@ static bool HTTPReq_JSONRPC(HTTPRequest* req, const std::string &)
159162
return false;
160163
}
161164

162-
if (!RPCAuthorized(authHeader.second)) {
165+
JSONRPCRequest jreq;
166+
if (!RPCAuthorized(authHeader.second, jreq.authUser)) {
163167
LogPrintf("ThreadRPCServer incorrect password attempt from %s\n", req->GetPeer().ToString());
164168

165169
/* Deter brute-forcing
@@ -172,7 +176,6 @@ static bool HTTPReq_JSONRPC(HTTPRequest* req, const std::string &)
172176
return false;
173177
}
174178

175-
JSONRPCRequest jreq;
176179
try {
177180
// Parse request
178181
UniValue valRequest;

src/rest.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,7 @@ static bool rest_chaininfo(HTTPRequest* req, const std::string& strURIPart)
286286
switch (rf) {
287287
case RF_JSON: {
288288
JSONRPCRequest jsonRequest;
289+
jsonRequest.params = UniValue(UniValue::VARR);
289290
UniValue chainInfoObject = getblockchaininfo(jsonRequest);
290291
string strJSON = chainInfoObject.write() + "\n";
291292
req->WriteHeader("Content-Type", "application/json");

src/rpc/server.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,9 @@ class JSONRPCRequest
4949
UniValue params;
5050
bool fHelp;
5151
std::string URI;
52+
std::string authUser;
5253

53-
JSONRPCRequest() { id = NullUniValue; }
54+
JSONRPCRequest() { id = NullUniValue; params = NullUniValue; fHelp = false; }
5455
void parse(const UniValue& valRequest);
5556
};
5657

0 commit comments

Comments
 (0)