From 15787c1edec1bbe1034b5327a9d6efa710db480b Mon Sep 17 00:00:00 2001 From: ritt Date: Mon, 9 Dec 2019 15:21:04 +0100 Subject: [PATCH] Check access to logbook before executing retrieve_url() --- src/elogd.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/elogd.c b/src/elogd.c index c599f724..4d992607 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -28496,6 +28496,14 @@ void decode_post(char *logbook, LOGBOOK *lbs, const char *string, const char *bo /* check for URL */ if (stristr(file_name, "http://") || stristr(file_name, "https://")) { + + // check for logbook access + if (getcfg(lbs->name, "Password file", str, sizeof(str))) { + if (!check_login(lbs, getparam("sid"))) { + return; + } + } + size = retrieve_url(lbs, file_name, stristr(file_name, "https://") != NULL, &buffer, FALSE); if (size <= 0) { strencode2(str2, file_name, sizeof(str2));