velvox
/
litecord
mirror of https://gitlab.com/litecord/litecord.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

gateway.websocket: add READ_MESSAGES check on OP 14 handler 

this should make sure to not leak information through shard queries.
This commit is contained in:
Luna Mendes 2018-11-21 21:09:19 -03:00
parent ddbfa6af4c
commit c7f6c5c6b4
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
litecord/gateway/websocket.py
View File

@ -6,21 +6,25 @@ import json
from typing import List, Dict, Any from typing import List, Dict, Any
from random import randint from random import randint
import earl
import websockets import websockets
from logbook import Logger from logbook import Logger
import earl
from litecord.errors import WebsocketClose, Unauthorized, Forbidden, BadRequest
from litecord.auth import raw_token_check from litecord.auth import raw_token_check
from litecord.enums import RelationshipType from litecord.enums import RelationshipType
from litecord.schemas import validate, GW_STATUS_UPDATE from litecord.schemas import validate, GW_STATUS_UPDATE
from litecord.utils import task_wrapper from litecord.utils import task_wrapper
from litecord.permissions import get_permissions
from .errors import DecodeError, UnknownOPCode, \ from litecord.gateway.opcodes import OP
InvalidShard, ShardingRequired from litecord.gateway.state import GatewayState
from .opcodes import OP
from .state import GatewayState
from litecord.errors import (
WebsocketClose, Unauthorized, Forbidden, BadRequest
)
from .errors import (
DecodeError, UnknownOPCode, InvalidShard, ShardingRequired
)
log = Logger(__name__) log = Logger(__name__)
WebsocketProperties = collections.namedtuple( WebsocketProperties = collections.namedtuple(
@ -788,7 +792,12 @@ class GatewayWebsocket:
chan_id = int(chan_id) chan_id = int(chan_id)
member_list = await lazy_guilds.get_gml(chan_id) member_list = await lazy_guilds.get_gml(chan_id)
# TODO: check read_messages permission perms = await get_permissions(
self.state.user_id, chan_id, self.storage)
if not perms.read_messages:
# ignore requests to unknown channels
return
await member_list.shard_query( await member_list.shard_query(
self.state.session_id, ranges self.state.session_id, ranges