Compare commits

...

3 Commits

Author SHA1 Message Date
Joe Cheng
9444bf82ee Try fixing GHA failure by busting the cache 2023-02-13 12:31:56 -08:00
Joe Cheng
70114125ba Code review feedback 2023-02-13 09:16:05 -08:00
Joe Cheng
02ea53c5e9 Ensure logged-in user matches when handling session-specific routes 2023-01-12 16:50:00 -08:00
2 changed files with 22 additions and 0 deletions

View File

@@ -21,3 +21,5 @@ jobs:
node-version: "14.x"
R-CMD-check:
uses: rstudio/shiny-workflows/.github/workflows/R-CMD-check.yaml@v1
with:
cache-version: "2.1"

View File

@@ -1876,6 +1876,26 @@ ShinySession <- R6Class(
# Provides a mechanism for handling direct HTTP requests that are posted
# to the session (rather than going through the websocket)
handleRequest = function(req) {
if (!is.null(self$user)) {
if (is.null(req$HTTP_SHINY_SERVER_CREDENTIALS)) {
# Session owner is logged in, but this requester is not
return(NULL)
}
requestUser <- NULL
try(
{
creds <- safeFromJSON(req$HTTP_SHINY_SERVER_CREDENTIALS)
requestUser <- creds$user
},
silent = TRUE
)
if (!identical(self$user, requestUser)) {
# This requester is not the same user as session owner
return(NULL)
}
}
# TODO: Turn off caching for the response
subpath <- req$PATH_INFO