From 855dfa0e2f8ca7869d28d2afc21fed2e3790549a Mon Sep 17 00:00:00 2001
From: Nils Maier <maierman@web.de>
Date: Sat, 17 May 2014 17:31:21 +0200
Subject: Authorize RPC multicalls only once.

Cache the auth status afterwards and just assume the token still matches
(within the same request, of course).
---
 src/RpcMethod.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/RpcMethod.cc')

diff --git a/src/RpcMethod.cc b/src/RpcMethod.cc
index 1f7ea20b..ec424300 100644
--- a/src/RpcMethod.cc
+++ b/src/RpcMethod.cc
@@ -85,9 +85,11 @@ void RpcMethod::authorize(RpcRequest& req, DownloadEngine* e)
       }
     }
   }
-  if (!e || !e->validateToken(token)) {
+  if (!e || (req.authorization != RpcRequest::PREAUTHORIZED &&
+        !e->validateToken(token))) {
     throw DL_ABORT_EX("Unauthorized");
   }
+  req.authorization = RpcRequest::PREAUTHORIZED;
 }
 
 RpcResponse RpcMethod::execute(RpcRequest req, DownloadEngine* e)
-- 
cgit