From 3ea6890c3463a987d6ad9fed46f743e45b1843a5 Mon Sep 17 00:00:00 2001 From: angelblue05 Date: Sun, 27 Jan 2019 14:49:35 -0600 Subject: [PATCH] Filter webservice requests Only proceed if the id is a number. --- resources/lib/webservice.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/resources/lib/webservice.py b/resources/lib/webservice.py index 5ef21824..34826af0 100644 --- a/resources/lib/webservice.py +++ b/resources/lib/webservice.py @@ -164,6 +164,10 @@ class StoppableHttpRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler): ''' try: params = self.get_params() + + if not params.get('Id').isdigit(): + raise IndexError("Incorrect Id format: %s" % params.get('Id')) + LOG.info("Webservice called with params: %s", params) path = ("plugin://plugin.video.emby?mode=play&id=%s&dbid=%s&filename=%s&transcode=%s" @@ -176,6 +180,10 @@ class StoppableHttpRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler): if not headers_only: self.wfile.write(path) + except IndexError as error: + + LOG.error(error) + self.send_error(403) except Exception as error: