Forbidding REST clients to set the node or IP

This is done for security reasons - if a client is
unauthenticated, we don't want them to be able to
just configure their own authentication information.

Signed-off-by: Luke Kanies <luke@madstop.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/lib/puppet/network/http/handler.rb b/lib/puppet/network/http/handler.rb
index db12a8b67..04ba14401 100644
--- a/lib/puppet/network/http/handler.rb
+++ b/lib/puppet/network/http/handler.rb
@@ -160,6 +160,12 @@ module Puppet::Network::HTTP::Handler
     def decode_params(params)
         params.inject({}) do |result, ary|
             param, value = ary
+            param = param.to_sym
+
+            # These shouldn't be allowed to be set by clients
+            # in the query string, for security reasons.
+            next result if param == :node
+            next result if param == :ip
             value = URI.unescape(value)
             if value =~ /^---/
                 value = YAML.load(value)
@@ -169,7 +175,7 @@ module Puppet::Network::HTTP::Handler
                 value = Integer(value) if value =~ /^\d+$/
                 value = value.to_f if value =~ /^\d+\.\d+$/
             end
-            result[param.to_sym] = value
+            result[param] = value
             result
         end
     end