[vlc-commits] lua/http: disable if password is unset

Mon Sep 7 20:15:37 CEST 2020

vlc/vlc-3.0 | branch: master | Pierre Ynard <linkfanel at yahoo.fr> | Mon Sep  7 19:42:34 2020 +0200| [234bd4ed81eda9dc49672b770066fcff6148d10f] | committer: Pierre Ynard

lua/http: disable if password is unset

There is currently a feature doing this in the lua bindings, but it is
problematic for several reasons: it doesn't reject insecure requests,
but only masks their output, while actually still going ahead and
silently honoring them; the web interface still recurses through its
directory and registers all endpoints, and exposes their existence by
answering differently depending on the request URL; the lua bindings are
the wrong level to do this, as it precludes any other lua user of the
HTTPd than the web interface; and it hijacks the response body to inject
its own regardless of the declared content type, potentially resulting
in getting it wrongly displayed.

Instead, this simply loads a single notice handler, and prints helpful
messages, directly from within the web interface module.

(cherry picked from commit ab87d0a17baa980f132221f5c99a64b74c243c57)
Signed-off-by: Pierre Ynard <linkfanel at yahoo.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=234bd4ed81eda9dc49672b770066fcff6148d10f
---

 share/lua/intf/http.lua | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/share/lua/intf/http.lua b/share/lua/intf/http.lua
index 391a333001..84ab2c58ff 100644
--- a/share/lua/intf/http.lua
+++ b/share/lua/intf/http.lua
@@ -105,6 +105,15 @@ function process(filename)
 end
 
 
+-- TODO: print localized error message
+-- For now this relies on lua bindings inappropriately doing so
+local function callback_nopassword()
+    return [[Status: 403
+Content-Length: 0
+
+]]
+end
+
 function callback_error(path,url,msg)
     local url = url or "<page unknown>"
     return  [[<html xmlns="http://www.w3.org/1999/xhtml">
@@ -327,5 +336,11 @@ end
 password = vlc.var.inherit(nil,"http-password")
 
 h = vlc.httpd()
-load_dir( http_dir )
-a = h:handler("/art",nil,password,callback_art,nil)
+if password == "" then
+    vlc.msg.err("Password unset, insecure web interface disabled")
+    vlc.msg.info("Set --http-password on the command line if you want to enable the web interface.")
+    p = h:handler("/",nil,nil,callback_nopassword,nil)
+else
+    load_dir( http_dir )
+    a = h:handler("/art",nil,password,callback_art,nil)
+end

