Merge branch 'master' of https://github.com/yacy/yacy_search_server

2 files changed, 44 insertions, 2 deletions

diff --git a/source/net/yacy/htroot/yacychat.java b/source/net/yacy/htroot/yacychat.java
new file mode 100644
index 000000000..db9d14eee
--- /dev/null
+++ b/source/net/yacy/htroot/yacychat.java
@@ -0,0 +1,33 @@
+package net.yacy.htroot;
+
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.json.JSONTokener;
+
+import net.yacy.cora.protocol.RequestHeader;
+import net.yacy.search.Switchboard;
+import net.yacy.server.serverObjects;
+import net.yacy.server.serverSwitch;
+
+public class yacychat {
+
+ public static serverObjects respond(@SuppressWarnings("unused") final RequestHeader header, final serverObjects post, final serverSwitch env) {
+     // return variable that accumulates replacements
+     final Switchboard sb = (Switchboard) env;
+
+     final serverObjects prop = new serverObjects();
+     String body = post == null ? "" : post.get("BODY", "");
+     JSONObject bodyj = new JSONObject();
+     if (body.length() > 0) {
+         try {
+             bodyj = new JSONObject(new JSONTokener(body));
+         } catch (JSONException e) {
+             // silently catch this
+         }
+     }
+
+     // return rewrite properties
+     return prop;
+ }
+
+}
\ No newline at end of file
diff --git a/source/net/yacy/http/servlets/RAGProxyServlet.java b/source/net/yacy/http/servlets/RAGProxyServlet.java
index 532e76a98..0545b3d40 100644
--- a/source/net/yacy/http/servlets/RAGProxyServlet.java
+++ b/source/net/yacy/http/servlets/RAGProxyServlet.java
@@ -51,6 +51,7 @@ import org.json.JSONObject;
 import net.yacy.ai.LLM;
 import net.yacy.cora.federate.solr.SolrType;
 import net.yacy.cora.federate.solr.connector.EmbeddedSolrConnector;
+import net.yacy.cora.protocol.Domains;
 import net.yacy.search.Switchboard;
 import net.yacy.search.schema.CollectionSchema;
 
@@ -88,6 +89,13 @@ public class RAGProxyServlet extends HttpServlet {
         hresponse.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
         hresponse.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
 
+        final String clientIP = hrequest.getRemoteAddr();
+        final boolean localhostAccess = Domains.isLocalhost(clientIP);
+        if (!localhostAccess) {
+            // we will introduce a rate limit for non-localhost later, for now we just don't allow it
+            hresponse.sendError(HttpServletResponse.SC_FORBIDDEN);
+        }
+        
         final Method reqMethod = Method.getMethod(hrequest.getMethod());
         if (reqMethod == Method.OTHER) {
             // required to handle CORS
@@ -147,9 +155,10 @@ public class RAGProxyServlet extends HttpServlet {
                 user += searchResultMarkdown;
                 userObject.put("content", user);
     
-                // write back modified bodyMap to body
-                body = bodyObject.toString();
             }
+            
+            // write back modified bodyMap to body
+            body = bodyObject.toString();
 
             // Open request to back-end service
             URL url = new URI(llm4Chat.llm.hoststub + "/v1/chat/completions").toURL();