BigBlueButton/bigbluebutton-Github
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3809 from ritzalam/match-userid-with-token

Browse Source 
Check userId when validating token
This commit is contained in:
Anton Georgiev 2017-04-11 15:54:12 -04:00 committed by GitHub
commit a8ac6fa0a5
2 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/UsersApp.scala
View File

@ -86,7 +86,7 @@ trait UsersApp {
def handleValidateAuthToken(msg: ValidateAuthToken) {
log.info("Got ValidateAuthToken message. meetingId=" + msg.meetingID + " userId=" + msg.userId)
usersModel.getRegisteredUserWithToken(msg.token) match {
usersModel.getRegisteredUserWithToken(msg.token, msg.userId) match {
case Some(u) =>
{
val replyTo = mProps.meetingID + '/' + msg.userId
@ -319,7 +319,7 @@ trait UsersApp {
def handleUserJoin(msg: UserJoining): Unit = {
log.debug("Received user joined meeting. metingId=" + mProps.meetingID + " userId=" + msg.userID)
val regUser = usersModel.getRegisteredUserWithToken(msg.authToken)
val regUser = usersModel.getRegisteredUserWithToken(msg.authToken, msg.userID)
regUser foreach { ru =>
log.debug("Found registered user. metingId=" + mProps.meetingID + " userId=" + msg.userID + " ru=" + ru)

17
akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/UsersModel.scala
View File

@ -38,8 +38,21 @@ class UsersModel {
regUsers += token -> regUser
}
def getRegisteredUserWithToken(token: String): Option[RegisteredUser] = {
regUsers.get(token)
def getRegisteredUserWithToken(token: String, userId: String): Option[RegisteredUser] = {
def isSameUserId(ru: RegisteredUser, userId: String): Option[RegisteredUser] = {
if (userId.startsWith(ru.id)) {
Some(ru)
} else {
None
}
}
for {
ru <- regUsers.get(token)
user <- isSameUserId(ru, userId)
} yield user
}
def generateWebUserId: String = {