tileradotorg/synapse
1
0
Fork 0
forked from MirrorHub/synapse
Code Pull requests Activity

Remove ultimately unused feature of saving params from the first call in the session: it's probably too open to abuse.

Browse source
This commit is contained in:
David Baker 2015-04-23 14:44:12 +01:00
parent a2c10d37d7
commit 0eb61a3d16
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
synapse/handlers/auth.py
View file

@ -78,8 +78,16 @@ class AuthHandler(BaseHandler):
sess = self._get_session_info(sid)
if len(clientdict) > 0:
sess['clientdict'] = clientdict
self._save_session(sess)
# This was designed to allow the client to omit the parameters
# and just supply the session in subsequent calls so it split
# auth between devices by just sharing the session, (eg. so you
# could continue registration from your phone having clicked the
# email auth link on there). It's probably too open to abuse
# because it lets unauthenticated clients store arbitrary objects
# on a home server.
#sess['clientdict'] = clientdict
#self._save_session(sess)
pass
elif 'clientdict' in sess:
clientdict = sess['clientdict']