That’s true but is not that your changes on line 156 will have those check and if successful it will call handleProcessedMessage. 

 

This is generic function for both TLS and WebSocket connections... 

 

From: John Lyle [mailto:notifications@github.com] 
Sent: 07 June 2013 10:50
To: webinos/webinos-pzp
Cc: Habib Virji
Subject: Re: [webinos-pzp] System test/ synchronization and remove friendlyName (#21)

 

In lib/pzp_receiveMessage.js:

> +        } finally {
> +            conn.resume ();// unlocks socket.
> +        }
> +    };
> +
> +    this.handleProcessedMessage = function(validMsgObj, conn) {
> +        logger.log ("msg received " + JSON.stringify (validMsgObj));
> +        if (PzpObject.checkConnectedPzh(validMsgObj.from)    || // Currently Connected PZH
> +            PzpObject.checkConnectedPzp(validMsgObj.from)    || // Currently Connected PZPs
> +            PzpObject.checkConnectedWebApp(validMsgObj.from) || // Currently Connected PZH
> +            validMsgObj.payload.status === "registerBrowser" || // Special exception as this is first msg from browser
> +            expectedPzhAddress                               || // Enrollment message comes from this address
> +            PzpObject.checkTrustedList(validMsgObj.from)   // Entities that are trusted might in same zone or outside zone
> +            ){
> +            if (validMsgObj.type === "prop") {
> +                methods[validMsgObj.payload.status].apply(PzpObject,[validMsgObj, conn]);

These methods need to be given the origin of the message - e.g., the websocket origin, not the message.from address, as that can be spoofed.

—
Reply to this email directly or view it on GitHub <https://github.com/webinos/webinos-pzp/pull/21/files#r4585684> .  <https://github.com/notifications/beacon/XUg7godVN2O0jV1-5T0xO9NSB5W6rANo54spR6MQzO5RsvUzPYxpjHrlVPu0KcZl.gif>