diff options
| author |  Sadie Powell | 2026-06-06 13:47:59 +0100 |
|---|---|---|
| committer | Sadie Powell | 2026-06-06 13:47:59 +0100 |
| commit | 65603ba4aa8c8ad3b6c4dac6018962934246e7fa (patch) | |
| tree | 0f41b5da15ff404e58c32f86f6ada9fd3906ac2f /modules/websocket.cpp | |
| parent | Update my email address. (diff) | |
| parent | Fix escaping LDAP search filters in ldapauth and ldapoper. (diff) | |
Merge branch 'insp4' into master.
Diffstat (limited to 'modules/websocket.cpp')
| -rw-r--r-- | modules/websocket.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/modules/websocket.cpp b/modules/websocket.cpp index da56b5882..571645881 100644 --- a/modules/websocket.cpp +++ b/modules/websocket.cpp @@ -722,6 +722,12 @@ public: if (allow.empty()) throw ModuleException(weak_from_this(), "<wsorigin:allow> is a mandatory field, at " + tag->source.str()); + if (insp::ascii_equals(allow, "*") || insp::ascii_equals(allow, "http://*") || insp::ascii_equals(allow, "https://*")) + { + ServerInstance->Logs.Warning(MODNAME, "<wsorigin> tag for {} at {} allows any website to connect to your server, this puts you at risk of web-based spam attacks!", + allow, tag->source.str()); + } + config.allowedorigins.push_back(allow); } |