From: Jo-Philipp Wich <jow@openwrt.org>
Date: Fri, 13 Sep 2013 12:44:57 +0000 (+0200)
Subject: ubus: deny requests with a "ubus_rpc_session" toplevel attribute to prevent injecting... 
X-Git-Url: http://git.openwrt.org/?p=project%2Fuhttpd.git;a=commitdiff_plain;h=3864c083a42e713e291bd954b2fa6fe2b85e930a

ubus: deny requests with a "ubus_rpc_session" toplevel attribute to prevent injecting different SIDs
---

diff --git a/ubus.c b/ubus.c
index 3c11246..0d41c2d 100644
--- a/ubus.c
+++ b/ubus.c
@@ -250,8 +250,11 @@ static void uh_ubus_send_request(struct client *cl, json_object *obj, const char
 	int ret, rem;
 
 	blob_buf_init(&req, 0);
-	blobmsg_for_each_attr(cur, args, rem)
+	blobmsg_for_each_attr(cur, args, rem) {
+		if (!strcmp(blobmsg_name(cur), "ubus_rpc_session"))
+			return uh_ubus_json_error(cl, ERROR_PARAMS);
 		blobmsg_add_blob(&req, cur);
+	}
 
 	blobmsg_add_string(&req, "ubus_rpc_session", sid);