r20559: Web Application Framework

- Disallow, for now, any ScriptTransport access.  A serious security issue has
  been described, and since we don't currently need it for anything, disable
  it completely.

- Continued clean-up towards implementing the common authentication code
(This used to be commit 07817a5489dd8cc6c85c10116f4dba43d798ef03)

1 files changed, 7 insertions, 1 deletions

diff --git a/services/json_auth.esp b/services/json_auth.esp
index 2d58b6e2af..0fdd98037d 100644
--- a/services/json_auth.esp
+++ b/services/json_auth.esp
@@ -1,7 +1,13 @@
 <%
 /* Return true to allow access; false otherwise */
-function json_authenticate(serviceComponents, method)
+function json_authenticate(serviceComponents, method, scriptTransportId)
 {
+    // Don't allow any access via ScriptTransport, for now.
+    if (scriptTransportId != jsonrpc.Constant.ScriptTransport.NotInUse)
+    {
+        return false;
+    }
+
     return true;
 }