infra
/
cryptpad
2
1
Fork 0
Code Issues Pull Requests Projects Releases 1 Activity

forbid cache poisoning via botched reset calls

pull/1/head
ansuz 2017-06-28 11:36:34 +02:00
parent 7439bbaba2
commit 9d83214158
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
rpc.js
View File

@ -578,8 +578,7 @@ var resetUserPins = function (Env, publicKey, channelList, cb) {
});
}
var pins = session.channels = {};
var pins = {};
getMultipleFileSize(Env, channelList, function (e, sizes) {
if (e) { return void cb(e); }
var pinSize = sumChannelSizes(sizes);
@ -606,6 +605,8 @@ var resetUserPins = function (Env, publicKey, channelList, cb) {
pins[channel] = true;
});
// update in-memory cache IFF the reset was allowed.
session.channels = pins;
getHash(Env, publicKey, function (e, hash) {
cb(e, hash);
});