oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't leak allowed origins in error message

Browse source
This commit is contained in:
shortcutme 2019-09-02 02:09:53 +02:00
parent 3c4bc6ae35
commit 9ac96cdd50
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Ui/UiRequest.py
View file

@ -735,7 +735,7 @@ class UiRequest(object):
origin_host = origin.split("://", 1)[-1]
if origin_host != host and origin_host not in self.server.allowed_ws_origins:
ws.send(json.dumps({"error": "Invalid origin: %s" % origin}))
return self.error403("Invalid origin: %s %s" % (origin, self.server.allowed_ws_origins))
return self.error403("Invalid origin: %s" % origin)
# Find site by wrapper_key
wrapper_key = self.get["wrapper_key"]