BigBlueButton/bigbluebutton-Github
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

move header rewrite higher to avoid spoofing

Browse Source
This commit is contained in:
Chad Pilkey 2017-11-10 13:50:26 -05:00
parent 7b7a40a333
commit 44d1e252ad
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
bbb-apps-common/src/main/scala/org/bigbluebutton/client/meeting/UserActor.scala
View File

@ -94,17 +94,18 @@ class UserActor(val userId: String,
val (result, error) = Deserializer.toBbbCoreMessageFromClient(msg.json)
result match {
case Some(msgFromClient) =>
val routing = Routing.addMsgFromClientRouting(msgFromClient.header.meetingId, msgFromClient.header.userId)
val envelope = new BbbCoreEnvelope(msgFromClient.header.name, routing)
if (msgFromClient.header.name == "ClientToServerLatencyTracerMsg") {
log.info("-- trace -- " + msg.json)
}
// Override the meetingId and userId on the message from client. This
// will prevent spoofing of messages. (ralam oct 30, 2017)
val newHeader = BbbClientMsgHeader(msgFromClient.header.name, meetingId, userId)
val msgClient = msgFromClient.copy(header = newHeader)
val routing = Routing.addMsgFromClientRouting(msgClient.header.meetingId, msgClient.header.userId)
val envelope = new BbbCoreEnvelope(msgClient.header.name, routing)
if (msgClient.header.name == "ClientToServerLatencyTracerMsg") {
log.info("-- trace -- " + msg.json)
}
val json = JsonUtil.toJson(msgClient)
for {
jsonNode <- convertToJsonNode(json)