From 80d9722964c923aa2c75125c902a8d8565a8e0fc Mon Sep 17 00:00:00 2001 From: mdipierro Date: Tue, 26 Aug 2014 14:21:28 -0500 Subject: [PATCH] more security, thanks Niphlod --- gluon/main.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gluon/main.py b/gluon/main.py index e6e33059..e3a2546a 100644 --- a/gluon/main.py +++ b/gluon/main.py @@ -366,7 +366,8 @@ def wsgibase(environ, responder): folder = abspath('applications', app) + os.sep, ajax = x_req_with == 'xmlhttprequest', cid = env.http_web2py_component_element, - is_local = env.remote_addr in local_hosts, + is_local = (env.remote_addr in local_hosts and + request.client == env.remote_addr) is_shell = cmd_opts and cmd_opts.shell, is_sheduler = cmd_opts and cmd_opts.scheduler, is_https = env.wsgi_url_scheme in HTTPS_SCHEMES or \