Restrict Web API usage on default credentials

src/webui/api/appcontroller.cpp

@@ -747,9 +747,19 @@ void AppController::setPreferencesAction()
         pref->setWebUIHttpsKeyPath(Path(it.value().toString()));
     // Authentication
     if (hasKey(u"web_ui_username"_qs))
-        pref->setWebUiUsername(it.value().toString());
+    {
+        const QString username = it.value().toString();
+        pref->setWebUiUsername(username);
+        if (!username.isEmpty() && (username != u"admin"_qs))
+            static_cast<WebSession*>(parent())->setRestricted(false);
+    }
     if (hasKey(u"web_ui_password"_qs))
+    {
+        const QString password = it.value().toString();
         pref->setWebUIPassword(Utils::Password::PBKDF2::generate(it.value().toByteArray()));
+        if (const QString password = it.value().toString(); !password.isEmpty() && (password != u"adminadmin"_qs))
+            static_cast<WebSession*>(parent())->setRestricted(false);
+    }
     if (hasKey(u"bypass_local_auth"_qs))
         pref->setWebUiLocalAuthEnabled(!it.value().toBool());
     if (hasKey(u"bypass_auth_subnet_whitelist_enabled"_qs))

src/webui/api/authcontroller.cpp

@@ -75,7 +75,9 @@ void AuthController::loginAction()
     {
         m_clientFailedLogins.remove(clientAddr);
 
-        m_sessionManager->sessionStart();
+        const bool restricted = (Utils::Password::slowEquals(usernameFromWeb.toUtf8(), u"admin"_qs.toUtf8())
+                                 && Utils::Password::slowEquals(passwordFromWeb.toUtf8(), u"adminadmin"_qs.toUtf8()));
+        m_sessionManager->sessionStart(restricted);
         setResult(u"Ok."_qs);
         LogMsg(tr("WebAPI login success. IP: %1").arg(clientAddr));
     }

src/webui/api/isessionmanager.h

@@ -43,6 +43,6 @@ struct ISessionManager
     virtual ~ISessionManager() = default;
     virtual QString clientId() const = 0;
     virtual ISession *session() = 0;
-    virtual void sessionStart() = 0;
+    virtual void sessionStart(bool restrictedAccess) = 0;
     virtual void sessionEnd() = 0;
 };

src/webui/webapplication.cpp

@@ -311,6 +311,9 @@ void WebApplication::doProcessRequest()
             throw MethodNotAllowedHTTPError();
     }
 
+    if (session() && session()->isRestricted() && !isRestrictedAPI(scope, action))
+        throw ForbiddenHTTPError(u"You must change the default credentials before being able to use the Web API unrestricted."_qs);
+
     DataMap data;
     for (const Http::UploadedFile &torrent : request().files)
         data[torrent.filename] = torrent.data;
@@ -617,7 +620,7 @@ void WebApplication::sessionInitialize()
     }
 
     if (!m_currentSession && !isAuthNeeded())
-        sessionStart();
+        sessionStart(false);
 }
 
 QString WebApplication::generateSid() const
@@ -650,7 +653,27 @@ bool WebApplication::isPublicAPI(const QString &scope, const QString &action) co
     return m_publicAPIs.contains(u"%1/%2"_qs.arg(scope, action));
 }
 
-void WebApplication::sessionStart()
+bool WebApplication::isRestrictedAPI(const QString &scope, const QString &action) const
+{
+    // Proof-of-concept code
+    // It should be generalized if approved
+    if (scope == u"app"_qs && action == u"setPreferences"_qs)
+    {
+        const QVariantHash m = QJsonDocument::fromJson(m_params[u"json"_qs].toUtf8()).toVariant().toHash();
+        QVariantHash::ConstIterator it;
+        const auto hasKey = [&it, &m](const QString &key) -> bool
+        {
+            it = m.find(key);
+            return (it != m.constEnd());
+        };
+
+        return (hasKey(u"web_ui_username"_qs) || hasKey(u"web_ui_password"_qs));
+    }
+
+    return false;
+}
+
+void WebApplication::sessionStart(bool restrictedAccess)
 {
     Q_ASSERT(!m_currentSession);
 
@@ -667,6 +690,7 @@ void WebApplication::sessionStart()
     });
 
     m_currentSession = new WebSession(generateSid(), app());
+    m_currentSession->setRestricted(restrictedAccess);
     m_currentSession->registerAPIController<AppController>(u"app"_qs);
     m_currentSession->registerAPIController<LogController>(u"log"_qs);
     m_currentSession->registerAPIController<RSSController>(u"rss"_qs);
@@ -843,6 +867,16 @@ void WebSession::updateTimestamp()
     m_timer.start();
 }
 
+bool WebSession::isRestricted() const
+{
+    return m_restricted;
+}
+
+void WebSession::setRestricted(bool restricted)
+{
+    m_restricted = restricted;
+}
+
 APIController *WebSession::getAPIController(const QString &scope) const
 {
     return m_apiControllers.value(scope);

src/webui/webapplication.h

@@ -67,6 +67,8 @@ class WebSession final : public QObject, public ApplicationComponent, public ISe
 
     bool hasExpired(qint64 seconds) const;
     void updateTimestamp();
+    bool isRestricted() const;
+    void setRestricted(bool restricted);
 
     template <typename T>
     void registerAPIController(const QString &scope)
@@ -78,6 +80,7 @@ class WebSession final : public QObject, public ApplicationComponent, public ISe
     APIController *getAPIController(const QString &scope) const;
 
 private:
+    bool m_restricted = true;
     const QString m_sid;
     QElapsedTimer m_timer;  // timestamp
     QMap<QString, APIController *> m_apiControllers;
@@ -99,7 +102,7 @@ class WebApplication final
 
     QString clientId() const override;
     WebSession *session() override;
-    void sessionStart() override;
+    void sessionStart(bool restrictedAccess) override;
     void sessionEnd() override;
 
     const Http::Request &request() const;
@@ -121,6 +124,7 @@ class WebApplication final
     void sessionInitialize();
     bool isAuthNeeded();
     bool isPublicAPI(const QString &scope, const QString &action) const;
+    bool isRestrictedAPI(const QString &scope, const QString &action) const;
 
     bool isCrossSiteRequest(const Http::Request &request) const;
     bool validateHostHeader(const QStringList &domains) const;