lzc256
/
tailscale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipn/localapi: require write access to PATCH prefs 

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
pull/1691/head
Brad Fitzpatrick 2021-04-11 21:31:15 -07:00
parent 3d81e6260b
commit 303805a389
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ipn/localapi/localapi.go
View File

@ -228,6 +228,10 @@ func (h *Handler) servePrefs(w http.ResponseWriter, r *http.Request) {
var prefs *ipn.Prefs
switch r.Method {
case "PATCH":
if !h.PermitWrite {
http.Error(w, "prefs write access denied", http.StatusForbidden)
return
}
mp := new(ipn.MaskedPrefs)
if err := json.NewDecoder(r.Body).Decode(mp); err != nil {
http.Error(w, err.Error(), 400)