stv0g/tvheadend
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

htsp server: review channel access verification, fixes #2505

Browse source
This commit is contained in:
Jaroslav Kysela 2014-11-24 09:01:59 +01:00
parent d6bfd1ffe6
commit fe24184ded
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/htsp_server.c
View file

@ -1096,7 +1096,7 @@ htsp_method_getEvents(htsp_connection_t *htsp, htsmsg_t *in)
return htsp_error("Event does not exist");
/* Check access */
if (!htsp_user_access_channel(htsp, ch))
if (ch && !htsp_user_access_channel(htsp, ch))
return htsp_error("User does not have access");
numFollowing = htsmsg_get_u32_or_default(in, "numFollowing", 0);
@ -1192,7 +1192,7 @@ htsp_method_epgQuery(htsp_connection_t *htsp, htsmsg_t *in)
tvhtrace("htsp", "min_duration %d and max_duration %d", min_duration, max_duration);
/* Check access */
if (!htsp_user_access_channel(htsp, ch))
if (ch && !htsp_user_access_channel(htsp, ch))
return htsp_error("User does not have access");
/* Query */
@ -1345,8 +1345,10 @@ htsp_method_addDvrEntry(htsp_connection_t *htsp, htsmsg_t *in)
stop_extra = 0;
if(!htsmsg_get_u32(in, "channelId", &u32))
ch = channel_find_by_id(u32);
if(!htsmsg_get_u32(in, "eventId", &eventid))
if(!htsmsg_get_u32(in, "eventId", &eventid)) {
e = epg_broadcast_find_by_id(eventid);
ch = e->channel;
}
if(htsmsg_get_u32(in, "priority", &priority))
priority = DVR_PRIO_NORMAL;
if(htsmsg_get_u32(in, "retention", &retention))
@ -1357,7 +1359,7 @@ htsp_method_addDvrEntry(htsp_connection_t *htsp, htsmsg_t *in)
lang = htsp->htsp_language;
/* Check access */
if (!htsp_user_access_channel(htsp, ch))
if (ch && !htsp_user_access_channel(htsp, ch))
return htsp_error("User does not have access");
/* Manual timer */
@ -1553,7 +1555,7 @@ htsp_method_addAutorecEntry(htsp_connection_t *htsp, htsmsg_t *in)
comment = "";
/* Check access */
if (!htsp_user_access_channel(htsp, ch))
if (ch && !htsp_user_access_channel(htsp, ch))
return htsp_error("User does not have access");
dae = dvr_autorec_create_htsp(dvr_config_name, title, ch, approx_time, days_of_week,