Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certificate validation is bypassed on missing key #22

Closed
aw opened this issue Oct 10, 2016 · 1 comment
Closed

Certificate validation is bypassed on missing key #22

aw opened this issue Oct 10, 2016 · 1 comment
Assignees
Labels
Milestone

Comments

@aw
Copy link
Member

aw commented Oct 10, 2016

Certificate validation will return an error message (http-msg 400) if no public/private key is sent, but will continue processing and still end up calling (certs-update), because (http-msg 400) isn't final.

Luckily the backend scripts in Jidoteki Admin have safeguards and will return 1 (and fail) if there's no public/private key file, but this should still be corrected.

The bug can be found in the code here. It's a bit subtle, but essentially on L50 after calling (http-msg 400), the next condition (if Private.. will be called. Doh. Not what we expected.. 🤕 🌴

@aw aw added the bug label Oct 10, 2016
@aw aw self-assigned this Oct 10, 2016
@aw aw added this to the v1.12 milestone Oct 23, 2016
aw added a commit that referenced this issue Oct 27, 2016
  * Add error-code and error-message to status response. Update API docs. #23
  * Add '/services' #11 and fix '/certs' #22
  * Add jsrrdgraphs, update theme icons, improve UI dashboard, monitor, updates sections
  * Update documentation
@aw
Copy link
Member Author

aw commented Nov 23, 2016

Fixed.

@aw aw closed this as completed Nov 23, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant