From 08bace4e9ecf08273f094c0c6aa8b3363d38ac3e Mon Sep 17 00:00:00 2001 From: Michael Marley Date: Mon, 2 Apr 2018 19:11:31 -0400 Subject: [PATCH 1/1] Reject clients that attempt to login before the core is configured Properly-implemented clients should never try to do this, but if it is done, this patch prevents it from crashing the core. Thanks to @chaign_c (https://twitter.com/chaign_c/) for finding this issue. (cherry picked from commit e17fca767d60c06ca02bc5898ced04f06d3670bd) --- src/core/coreauthhandler.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/core/coreauthhandler.cpp b/src/core/coreauthhandler.cpp index c95fe303..26cdfcfc 100644 --- a/src/core/coreauthhandler.cpp +++ b/src/core/coreauthhandler.cpp @@ -204,6 +204,12 @@ void CoreAuthHandler::handle(const Login &msg) if (!checkClientRegistered()) return; + if (!Core::isConfigured()) { + qWarning() << qPrintable(tr("Client")) << qPrintable(socket()->peerAddress().toString()) << qPrintable(tr("attempted to login before the core was configured, rejecting.")); + _peer->dispatch(ClientDenied(tr("Attempted to login before core was configured!
The core must be configured before attempting to login."))); + return; + } + UserId uid = Core::validateUser(msg.user, msg.password); if (uid == 0) { quInfo() << qPrintable(tr("Invalid login attempt from %1 as \"%2\"").arg(socket()->peerAddress().toString(), msg.user)); -- 2.20.1