Skip to content

Ensure logged-in user matches when handling session-specific routes #3766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Ensure logged-in user matches when handling session-specific routes #3766

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02ea53c
Ensure logged-in user matches when handling session-specific routes
jcheng5 Jan 13, 2023
7011412
Code review feedback
jcheng5 Feb 13, 2023
9444bf8
Try fixing GHA failure by busting the cache
jcheng5 Feb 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions R/shiny.R
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1876,6 +1876,22 @@ ShinySession <- R6Class(
# Provides a mechanism for handling direct HTTP requests that are posted
# to the session (rather than going through the websocket)
handleRequest = function(req) {
if (!is.null(self$user)) {
if (is.null(req$HTTP_SHINY_SERVER_CREDENTIALS)) {
# Session owner is logged in, but this requester is not
return(NULL)
}

creds <- NULL
try({creds <- safeFromJSON(req$HTTP_SHINY_SERVER_CREDENTIALS)},
silent = TRUE
)
if (!identical(self$user, creds$user)) {
# This requester is not the same user as session owner
return(NULL)
}
}

# TODO: Turn off caching for the response
subpath <- req$PATH_INFO

Expand Down