From 05d98fe24c594ae43de4cd9f54139f8b04324119 Mon Sep 17 00:00:00 2001
From: Shadowghost <Ghost_of_Stone@web.de>
Date: Fri, 9 Jun 2023 17:11:22 +0200
Subject: Enforce permissions on websocket connections

---
 .../WebSocketListeners/SessionInfoWebSocketListener.cs       | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs')

diff --git a/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs b/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
index 0d8bf205c9..0d614ba4f2 100644
--- a/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
+++ b/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
@@ -1,5 +1,7 @@
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Jellyfin.Data.Enums;
+using MediaBrowser.Controller.Authentication;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Net;
 using MediaBrowser.Controller.Session;
@@ -66,6 +68,16 @@ public class SessionInfoWebSocketListener : BasePeriodicWebSocketListener<IEnume
         base.Dispose(dispose);
     }
 
+    private new void Start(WebSocketMessageInfo message)
+    {
+        if (!message.Connection.AuthorizationInfo.User.HasPermission(PermissionKind.IsAdministrator))
+        {
+            throw new AuthenticationException("Only admin users can subscribe to session information.");
+        }
+
+        base.Start(message);
+    }
+
     private async void OnSessionManagerSessionActivity(object? sender, SessionEventArgs e)
     {
         await SendData(false).ConfigureAwait(false);
-- 
cgit v1.2.3


From 368f9202ce0048b92b3b43ea78a96486f9cd23c4 Mon Sep 17 00:00:00 2001
From: Shadowghost <Ghost_of_Stone@web.de>
Date: Sat, 15 Jul 2023 20:14:31 +0200
Subject: Apply review suggestions

---
 Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs | 6 +++++-
 Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs | 6 +++++-
 MediaBrowser.Controller/Net/BasePeriodicWebSocketListener.cs    | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

(limited to 'Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs')

diff --git a/Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs b/Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs
index 33d391f296..5b90d65d84 100644
--- a/Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs
+++ b/Jellyfin.Api/WebSocketListeners/ActivityLogWebSocketListener.cs
@@ -58,7 +58,11 @@ public class ActivityLogWebSocketListener : BasePeriodicWebSocketListener<Activi
         base.Dispose(dispose);
     }
 
-    private new void Start(WebSocketMessageInfo message)
+    /// <summary>
+    /// Starts sending messages over an activity log web socket.
+    /// </summary>
+    /// <param name="message">The message.</param>
+    protected override void Start(WebSocketMessageInfo message)
     {
         if (!message.Connection.AuthorizationInfo.User.HasPermission(PermissionKind.IsAdministrator))
         {
diff --git a/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs b/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
index 0d614ba4f2..b403ff46d0 100644
--- a/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
+++ b/Jellyfin.Api/WebSocketListeners/SessionInfoWebSocketListener.cs
@@ -68,7 +68,11 @@ public class SessionInfoWebSocketListener : BasePeriodicWebSocketListener<IEnume
         base.Dispose(dispose);
     }
 
-    private new void Start(WebSocketMessageInfo message)
+    /// <summary>
+    /// Starts sending messages over a session info web socket.
+    /// </summary>
+    /// <param name="message">The message.</param>
+    protected override void Start(WebSocketMessageInfo message)
     {
         if (!message.Connection.AuthorizationInfo.User.HasPermission(PermissionKind.IsAdministrator))
         {
diff --git a/MediaBrowser.Controller/Net/BasePeriodicWebSocketListener.cs b/MediaBrowser.Controller/Net/BasePeriodicWebSocketListener.cs
index 0ad1e4f50b..e0942e490b 100644
--- a/MediaBrowser.Controller/Net/BasePeriodicWebSocketListener.cs
+++ b/MediaBrowser.Controller/Net/BasePeriodicWebSocketListener.cs
@@ -96,7 +96,7 @@ namespace MediaBrowser.Controller.Net
         /// Starts sending messages over a web socket.
         /// </summary>
         /// <param name="message">The message.</param>
-        protected void Start(WebSocketMessageInfo message)
+        protected virtual void Start(WebSocketMessageInfo message)
         {
             var vals = message.Data.Split(',');
 
-- 
cgit v1.2.3