TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-29 13:05:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/localapi: require write access to PATCH prefs

Browse Source 
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2021-04-11 21:31:15 -07:00
parent 3d81e6260b
commit 303805a389
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ipn/localapi/localapi.go
View File

@ -228,6 +228,10 @@ func (h *Handler) servePrefs(w http.ResponseWriter, r *http.Request) {
var prefs *ipn.Prefs var prefs *ipn.Prefs
switch r.Method { switch r.Method {
case "PATCH": case "PATCH":
if !h.PermitWrite {
http.Error(w, "prefs write access denied", http.StatusForbidden)
return
}
mp := new(ipn.MaskedPrefs) mp := new(ipn.MaskedPrefs)
if err := json.NewDecoder(r.Body).Decode(mp); err != nil { if err := json.NewDecoder(r.Body).Decode(mp); err != nil {
http.Error(w, err.Error(), 400) http.Error(w, err.Error(), 400)