Make private services forbid llHTTPRequest() calls by rejecting those that have the X-SecondLife-Shard header.

If you need to enable this, set AllowHttpRequestIn = true in [Network] for all private services or individual [*Service] sections.

1 files changed, 10 insertions, 5 deletions

diff --git a/OpenSim/Framework/Servers/HttpServer/BaseStreamHandler.cs b/OpenSim/Framework/Servers/HttpServer/BaseStreamHandler.cs
index f160734..41aa19b 100644
--- a/OpenSim/Framework/Servers/HttpServer/BaseStreamHandler.cs
+++ b/OpenSim/Framework/Servers/HttpServer/BaseStreamHandler.cs
@@ -56,12 +56,17 @@ namespace OpenSim.Framework.Servers.HttpServer
             string path, Stream request, IOSHttpRequest httpRequest, IOSHttpResponse httpResponse)
         {
             RequestsReceived++;
-            if (m_Auth != null && !m_Auth.Authenticate(httpRequest.Headers, httpResponse.AddHeader))
+
+            if (m_Auth != null)
             {
-                
-                httpResponse.StatusCode = (int)HttpStatusCode.Unauthorized;
-                httpResponse.ContentType = "text/plain";
-                return new byte[0];
+                HttpStatusCode statusCode;
+
+                if (!m_Auth.Authenticate(httpRequest.Headers, httpResponse.AddHeader, out statusCode))
+                {                
+                    httpResponse.StatusCode = (int)statusCode;
+                    httpResponse.ContentType = "text/plain";
+                    return new byte[0];
+                }
             }
 
             byte[] result = ProcessRequest(path, request, httpRequest, httpResponse);