amass/ZLMediaKit
1
0
Fork 0
mirror of https://github.com/ZLMediaKit/ZLMediaKit.git synced 2024-11-22 19:00:01 +08:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

web hook不再直接放行来自127.0.0.1播放鉴权请求

Browse Source 
防止代理越过鉴权
This commit is contained in:
xia-chu 2023-07-27 15:51:07 +08:00
parent 2c8a46862b
commit 2bcbff09b0
1 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
server/WebHook.cpp
View File

@ -332,7 +332,7 @@ void installWebHook() {
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastMediaPublish, [](BroadcastMediaPublishArgs) {
GET_CONFIG(string, hook_publish, Hook::kOnPublish);
if (!hook_enable || hook_publish.empty() || sender.get_peer_ip() == "127.0.0.1") {
if (!hook_enable || hook_publish.empty()) {
invoker("", ProtocolOption());
return;
}
@ -357,7 +357,7 @@ void installWebHook() {
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastMediaPlayed, [](BroadcastMediaPlayedArgs) {
GET_CONFIG(string, hook_play, Hook::kOnPlay);
if (!hook_enable || hook_play.empty() || sender.get_peer_ip() == "127.0.0.1") {
if (!hook_enable || hook_play.empty()) {
invoker("");
return;
}
@ -371,7 +371,7 @@ void installWebHook() {
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastFlowReport, [](BroadcastFlowReportArgs) {
GET_CONFIG(string, hook_flowreport, Hook::kOnFlowReport);
if (!hook_enable || hook_flowreport.empty() || sender.get_peer_ip() == "127.0.0.1") {
if (!hook_enable || hook_flowreport.empty()) {
return;
}
auto body = make_json(args);
@ -390,7 +390,7 @@ void installWebHook() {
// 监听kBroadcastOnGetRtspRealm事件决定rtsp链接是否需要鉴权(传统的rtsp鉴权方案)才能访问
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastOnGetRtspRealm, [](BroadcastOnGetRtspRealmArgs) {
GET_CONFIG(string, hook_rtsp_realm, Hook::kOnRtspRealm);
if (!hook_enable || hook_rtsp_realm.empty() || sender.get_peer_ip() == "127.0.0.1") {
if (!hook_enable || hook_rtsp_realm.empty()) {
// 无需认证
invoker("");
return;
@ -539,7 +539,7 @@ void installWebHook() {
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastShellLogin, [](BroadcastShellLoginArgs) {
GET_CONFIG(string, hook_shell_login, Hook::kOnShellLogin);
if (!hook_enable || hook_shell_login.empty() || sender.get_peer_ip() == "127.0.0.1") {
if (!hook_enable || hook_shell_login.empty()) {
invoker("");
return;
}
@ -617,11 +617,6 @@ void installWebHook() {
// 追踪用户的目的是为了缓存上次鉴权结果，减少鉴权次数，提高性能
NoticeCenter::Instance().addListener(&web_hook_tag, Broadcast::kBroadcastHttpAccess, [](BroadcastHttpAccessArgs) {
GET_CONFIG(string, hook_http_access, Hook::kOnHttpAccess);
if (sender.get_peer_ip() == "127.0.0.1") {
// 如果是本机或超级管理员访问，那么不做访问鉴权；权限有效期1个小时
invoker("", "", 60 * 60);
return;
}
if (!hook_enable || hook_http_access.empty()) {
// 未开启http文件访问鉴权，那么允许访问，但是每次访问都要鉴权；
// 因为后续随时都可能开启鉴权(重载配置文件后可能重新开启鉴权)