theluyuan/shynet
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enforce origin checking on pixel trackers (indirectly fixes #65)

Browse Source
This commit is contained in:
R. Miles McCain 2020-08-11 21:56:20 +00:00
parent 2d42674e1a
commit 3e315f06ed
No known key found for this signature in database
GPG Key ID: F1053629E2905557
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
shynet/analytics/views/ingress.py
View File

@ -5,7 +5,7 @@ from urllib.parse import urlparse
from django.conf import settings from django.conf import settings
from django.core.cache import cache from django.core.cache import cache
from django.core.exceptions import ValidationError from django.core.exceptions import ValidationError
from django.http import Http404, HttpResponse, HttpResponseBadRequest from django.http import Http404, HttpResponse, HttpResponseBadRequest, HttpResponseForbidden
from django.shortcuts import render, reverse from django.shortcuts import render, reverse
from django.utils import timezone from django.utils import timezone
from django.utils.decorators import method_decorator from django.utils.decorators import method_decorator
@ -53,9 +53,14 @@ class ValidateServiceOriginsMixin:
if origins != "*": if origins != "*":
remote_origin = request.META.get("HTTP_ORIGIN") remote_origin = request.META.get("HTTP_ORIGIN")
origins = [origin.strip() for origin in origins.split(",")] if remote_origin is None and request.META.get("HTTP_REFERER") is not None:
parsed = urlparse(request.META.get("HTTP_REFERER"))
remote_origin = f"{parsed.scheme}://{parsed.netloc}".lower()
origins = [origin.strip().lower() for origin in origins.split(",")]
if remote_origin in origins: if remote_origin in origins:
resp["Access-Control-Allow-Origin"] = remote_origin resp["Access-Control-Allow-Origin"] = remote_origin
else:
return HttpResponseForbidden()
else: else:
resp["Access-Control-Allow-Origin"] = "*" resp["Access-Control-Allow-Origin"] = "*"