Can you make Jira Issue so that we do not lose sight of this issue.

( I could make one, but details have to come from you anyways)

 

From: John Lyle [mailto:notifications@github.com] 
Sent: 07 June 2013 11:13
To: webinos/webinos-pzp
Cc: Habib Virji
Subject: Re: [webinos-pzp] System test/ synchronization and remove friendlyName (#21)

 

In lib/pzp_receiveMessage.js:

> +                PzpObject.handleProcessedMessage(validMsgObj, conn);
> +            });
> +        } catch (err) {
> +            PzpObject.emit("EXCEPTION", new Error("failed in processing message received" + err));
> +        } finally {
> +            conn.resume ();// unlocks socket.
> +        }
> +    };
> +
> +    this.handleProcessedMessage = function(validMsgObj, conn) {
> +        logger.log ("msg received " + JSON.stringify (validMsgObj));
> +        if (PzpObject.checkConnectedPzh(validMsgObj.from)    || // Currently Connected PZH
> +            PzpObject.checkConnectedPzp(validMsgObj.from)    || // Currently Connected PZPs
> +            PzpObject.checkConnectedWebApp(validMsgObj.from) || // Currently Connected PZH
> +            validMsgObj.payload.status === "registerBrowser" || // Special exception as this is first msg from browser
> +            expectedPzhAddress                               || // Enrollment message comes from this address

For now, we should just disable setExpectedPzh when the PZP is already enrolled.

For the future, we need to have a whitelist of allowed origins that the WebSocket will accept connections from.

—
Reply to this email directly or view it on GitHub <https://github.com/webinos/webinos-pzp/pull/21/files#r4585967> .  <https://github.com/notifications/beacon/XUg7godVN2O0jV1-5T0xO9NSB5W6rANo54spR6MQzO5RsvUzPYxpjHrlVPu0KcZl.gif>