External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-14 19:30:39 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2648 from ryanpetrello/fix-ws-cross-origin

Browse Source 
[3.3.0] reject ws:// connections w/ origin mismatches
This commit is contained in:
Ryan Petrello 2018-07-24 10:13:46 -04:00 committed by GitHub
commit c0da6f04cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
awx/main/consumers.py
View File

@ -3,7 +3,9 @@ import logging
from channels import Group
from channels.auth import channel_session_user_from_http, channel_session_user
from channels.exceptions import DenyConnection
from django.conf import settings
from django.core.serializers.json import DjangoJSONEncoder
@ -18,6 +20,10 @@ def discard_groups(message):
@channel_session_user_from_http
def ws_connect(message):
origin = dict(message.content.get('headers', {})).get('origin')
if settings.DEBUG is False and origin != settings.TOWER_URL_BASE:
logger.error("ws:// origin header mismatch {} != {}".format(origin, settings.TOWER_URL_BASE))
raise DenyConnection()
message.reply_channel.send({"accept": True})
message.content['method'] = 'FAKE'
if message.user.is_authenticated():