smarter access control for RPC terminal/browser

Bitcoin-Clashic · May 11, 2018 · ef44105 · ef44105
1 parent b2dd79b
commit ef44105
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 10 deletions.
diff --git a/app/env.js b/app/env.js
@@ -1,6 +1,6 @@
 module.exports = {
 	cookiePassword: "0x000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
-	debug: false,
+	demoSite: true,
 	showForkBanner: false,
 	coin: "BTC",
 
@@ -34,6 +34,9 @@ module.exports = {
 		password:"rpc-password"
 	},
 
+	// Edit "ipWhitelistForRpcCommands" regex to limit access to RPC Browser / Terminal to matching IPs
+	ipWhitelistForRpcCommands:/^(127\.0\.0\.1)?(\:\:1)?$/,
+
 	donationAddresses:{
 		coins:["BTC", "LTC"],
 

diff --git a/routes/baseActionsRouter.js b/routes/baseActionsRouter.js
@@ -413,20 +413,30 @@ router.get("/tx/:transactionId", function(req, res) {
 });
 
 router.get("/rpc-terminal", function(req, res) {
-	if (!env.debug) {
-		res.send("Debug mode is off.");
+	if (!env.demoSite) {
+		var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+		var match = env.ipWhitelistForRpcCommands.exec(ip);
 
-		return;
+		if (!match) {
+			res.send("RPC Terminal / Browser may not be accessed from '" + ip + "'. This restriction can be modified in your env.js file.");
+
+			return;
+		}
 	}
 
 	res.render("terminal");
 });
 
 router.post("/rpc-terminal", function(req, res) {
-	if (!env.debug) {
-		res.send("Debug mode is off.");
+	if (!env.demoSite) {
+		var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+		var match = env.ipWhitelistForRpcCommands.exec(ip);
 
-		return;
+		if (!match) {
+			res.send("RPC Terminal / Browser may not be accessed from '" + ip + "'. This restriction can be modified in your env.js file.");
+
+			return;
+		}
 	}
 
 	var params = req.body.cmd.split(" ");
@@ -476,10 +486,15 @@ router.post("/rpc-terminal", function(req, res) {
 });
 
 router.get("/rpc-browser", function(req, res) {
-	if (!env.debug) {
-		res.send("Debug mode is off.");
+	if (!env.demoSite) {
+		var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
+		var match = env.ipWhitelistForRpcCommands.exec(ip);
 
-		return;
+		if (!match) {
+			res.send("RPC Terminal / Browser may not be accessed from '" + ip + "'. This restriction can be modified in your env.js file.");
+
+			return;
+		}
 	}
 
 	rpcApi.getHelp().then(function(result) {