diff options
| author | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
|---|---|---|
| committer | luccioman <luccioman@users.noreply.github.com> | 2017-03-26 11:48:00 +0200 |
| commit | cde237b68763c542da20038e5f62bea341ae1d37 (patch) | |
| tree | a8a55d4425e9ad778e5737d920458a0dd8639abc /stopYACY.sh | |
| parent | df5970df6d4de27ef96641aadc2591c219e87a36 (diff) | |
Enforced access controls on some administrative actions.
- ensure use of HTTP POST method : HTTP GET should only be used for
information retrieval and not to perform server side effect operations
(see HTTP standard https://tools.ietf.org/html/rfc7231#section-4.2.1)
- a transaction token is now required for these administrative form
submissions to ensure the request can not be included in an external
site and performed silently/by mistake by the user browser
Diffstat (limited to 'stopYACY.sh')
| -rwxr-xr-x | stopYACY.sh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/stopYACY.sh b/stopYACY.sh index 1109eaad0..e643bdcb2 100755 --- a/stopYACY.sh +++ b/stopYACY.sh @@ -1,7 +1,7 @@ #!/usr/bin/env sh cd `dirname $0` -(bin/apicall.sh "Steering.html?shutdown=true" > /dev/null && \ +(bin/protectedPostApiCall.sh "Steering.html" "shutdown=true" > /dev/null && \ echo "Please wait until the YaCy daemon process terminates [wget]" && \ echo "You can monitor this with 'tail -f DATA/LOG/yacy00.log' and 'fuser log/yacy00.log'") || \ |