mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-02-22 22:25:28 +01:00
Code Issues Projects Releases Packages Wiki Activity

Prevent user to log in or register via unsecured network

Browse source
This commit is contained in:
nicolas.dorier 2019-04-04 14:28:11 +09:00
parent 4853e15d8a
commit d0eed9857d
4 changed files with 42 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
BTCPayServer/Controllers/ServerController.cs
View file

@ -680,7 +680,7 @@ namespace BTCPayServer.Controllers
return File(System.IO.File.ReadAllBytes(settings.KeyFile), "application/octet-stream", "id_rsa");
}
var server = IsLocalNetwork(settings.Server) ? this.Request.Host.Host: settings.Server;
var server = Extensions.IsLocalNetwork(settings.Server) ? this.Request.Host.Host: settings.Server;
SSHServiceViewModel vm = new SSHServiceViewModel();
string port = settings.Port == 22 ? "" : $" -p {settings.Port}";
vm.CommandLine = $"ssh {settings.Username}@{server}{port}";
@ -690,14 +690,6 @@ namespace BTCPayServer.Controllers
return View(vm);
}
private static bool IsLocalNetwork(string server)
{
return server.EndsWith(".internal", StringComparison.OrdinalIgnoreCase) ||
server.EndsWith(".local", StringComparison.OrdinalIgnoreCase) ||
server.Equals("127.0.0.1", StringComparison.OrdinalIgnoreCase) ||
server.Equals("localhost", StringComparison.OrdinalIgnoreCase);
}
[Route("server/theme")]
public async Task<IActionResult> Theme()
{

18
BTCPayServer/Extensions.cs
View file

@ -166,6 +166,24 @@ namespace BTCPayServer
(derivationStrategyBase is DirectDerivationStrategy direct) && direct.Segwit;
}
public static bool IsLocalNetwork(string server)
{
if (server == null)
throw new ArgumentNullException(nameof(server));
if (Uri.CheckHostName(server) == UriHostNameType.Dns)
{
return server.EndsWith(".internal", StringComparison.OrdinalIgnoreCase) ||
server.EndsWith(".local", StringComparison.OrdinalIgnoreCase) ||
server.EndsWith(".lan", StringComparison.OrdinalIgnoreCase) ||
server.IndexOf('.', StringComparison.OrdinalIgnoreCase) == -1;
}
if(IPAddress.TryParse(server, out var ip))
{
return ip.IsLocal();
}
return false;
}
public static bool IsOnion(this HttpRequest request)
{
if (request?.Host.Host == null)

12
BTCPayServer/Services/BTCPayServerEnvironment.cs
View file

@ -56,6 +56,18 @@ namespace BTCPayServer.Services
return NetworkType == NetworkType.Regtest && Environment.IsDevelopment();
}
}
public bool IsSecure
{
get
{
return NetworkType != NetworkType.Mainnet ||
httpContext.HttpContext.Request.Scheme == "https" ||
httpContext.HttpContext.Request.Host.Host.EndsWith(".onion", StringComparison.OrdinalIgnoreCase) ||
Extensions.IsLocalNetwork(httpContext.HttpContext.Request.Host.Host);
}
}
public override string ToString()
{
StringBuilder txt = new StringBuilder();

13
BTCPayServer/Views/Shared/_Layout.cshtml
View file

@ -85,13 +85,14 @@
<li class="nav-item">
<a asp-area="" asp-controller="Account" asp- asp-action="Logout" title="Manage" class="nav-link js-scroll-trigger">Log out</a>
</li>}
else
else if (env.IsSecure)
{
if (themeManager.ShowRegister)
{
<li class="nav-item"><a asp-area="" asp-controller="Account" asp-action="Register" class="nav-link js-scroll-trigger">Register</a></li>
}
<li class="nav-item"><a asp-area="" asp-controller="Account" asp-action="Login" class="nav-link js-scroll-trigger">Log in</a></li>}
<li class="nav-item"><a asp-area="" asp-controller="Account" asp-action="Login" class="nav-link js-scroll-trigger">Log in</a></li>
}
</ul>
</div>
@ -99,6 +100,14 @@
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<span>BTCPay is expecting you to access this website from <b>@(env.ExpectedProtocol)://@(env.ExpectedHost)/</b>. If you use a reverse proxy, please set the <b>X-Forwarded-Proto</b> header to <b id="browserScheme">@(env.ExpectedProtocol)</b> (<a href="https://docs.btcpayserver.org/faq-and-common-issues/faq-deployment#btcpay-is-expecting-you-to-access-this-website-from" target="_blank">More information</a>)</span>
</div>
@if (!env.IsSecure)
{
<div class="alert alert-danger alert-dismissible" style="position:absolute; top:75px;" role="alert">
<button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
<span>You access BTCPay Server over an unsecured network. If you are using docker deployment with NGINX and HTTPS is not available, you probably did not configured your DNS settings right. <br />
We disabled the register and login link so you don't leak your credentials.</span>
</div>
}
</div>
</nav>