Re: [Freeswitch-users] patch for sofia_sip_i_invite to support replaces with action
Couldn't this be a huge security vulnerability used to inject arbitrary commands into a session in FreeSWITCH?
isn't the call authenticated first ? anyway, an option can be added to sip_profile to allow this.
why don't you pass the call to mod_perl or Lua, and do all the necessary lookups in the script? This shpouldn;t be a big deal to implement, and much more safe than patching mod_sofia.
not an option, but thanks for suggesting
Sometimes the call is authenticated, sometimes not. Regardless, do you want any autheticated call to be able to run any arbitrary application including "system" on your switch?
On Apr 22, 2015, at 9:47 AM, Luis Azedo <luis.azedo@factorlusitano.com> wrote:
Couldn't this be a huge security vulnerability used to inject arbitrary commands into a session in FreeSWITCH?
isn't the call authenticated first ? anyway, an option can be added to sip_profile to allow this.
why don't you pass the call to mod_perl or Lua, and do all the necessary lookups in the script? This shpouldn;t be a big deal to implement, and much more safe than patching mod_sofia.
not an option, but thanks for suggesting
participants (2)
-
Luis Azedo
-
Michael Jerris