forked from Qortal/qortal
Add checks to API call POST /admin/forgingaccounts.
Now only accepts private keys for accounts with minting rights or derives to known proxy forging public key.
This commit is contained in:
parent
7409c024f6
commit
748dddcc32
@ -32,6 +32,7 @@ import javax.ws.rs.core.MediaType;
|
|||||||
import org.apache.logging.log4j.LogManager;
|
import org.apache.logging.log4j.LogManager;
|
||||||
import org.apache.logging.log4j.core.LoggerContext;
|
import org.apache.logging.log4j.core.LoggerContext;
|
||||||
import org.apache.logging.log4j.core.appender.RollingFileAppender;
|
import org.apache.logging.log4j.core.appender.RollingFileAppender;
|
||||||
|
import org.qora.account.Forging;
|
||||||
import org.qora.account.PrivateKeyAccount;
|
import org.qora.account.PrivateKeyAccount;
|
||||||
import org.qora.api.ApiError;
|
import org.qora.api.ApiError;
|
||||||
import org.qora.api.ApiErrors;
|
import org.qora.api.ApiErrors;
|
||||||
@ -238,8 +239,13 @@ public class AdminResource {
|
|||||||
public String addForgingAccount(String seed58) {
|
public String addForgingAccount(String seed58) {
|
||||||
try (final Repository repository = RepositoryManager.getRepository()) {
|
try (final Repository repository = RepositoryManager.getRepository()) {
|
||||||
byte[] seed = Base58.decode(seed58.trim());
|
byte[] seed = Base58.decode(seed58.trim());
|
||||||
|
|
||||||
// Check seed is valid
|
// Check seed is valid
|
||||||
new PrivateKeyAccount(null, seed);
|
PrivateKeyAccount forgingAccount = new PrivateKeyAccount(repository, seed);
|
||||||
|
|
||||||
|
// Account must derive to known proxy forging public key or have minting flag set
|
||||||
|
if (!Forging.canForge(forgingAccount) && !repository.getAccountRepository().isProxyPublicKey(forgingAccount.getPublicKey()))
|
||||||
|
throw ApiExceptionFactory.INSTANCE.createException(request, ApiError.INVALID_PRIVATE_KEY);
|
||||||
|
|
||||||
ForgingAccountData forgingAccountData = new ForgingAccountData(seed);
|
ForgingAccountData forgingAccountData = new ForgingAccountData(seed);
|
||||||
|
|
||||||
|
@ -89,6 +89,8 @@ public interface AccountRepository {
|
|||||||
|
|
||||||
public ProxyForgerData getProxyForgeData(byte[] proxyPublicKey) throws DataException;
|
public ProxyForgerData getProxyForgeData(byte[] proxyPublicKey) throws DataException;
|
||||||
|
|
||||||
|
public boolean isProxyPublicKey(byte[] publicKey) throws DataException;
|
||||||
|
|
||||||
public List<ProxyForgerData> findProxyAccounts(List<String> recipients, List<String> forgers, Integer limit, Integer offset, Boolean reverse) throws DataException;
|
public List<ProxyForgerData> findProxyAccounts(List<String> recipients, List<String> forgers, Integer limit, Integer offset, Boolean reverse) throws DataException;
|
||||||
|
|
||||||
public void save(ProxyForgerData proxyForgerData) throws DataException;
|
public void save(ProxyForgerData proxyForgerData) throws DataException;
|
||||||
|
@ -352,6 +352,15 @@ public class HSQLDBAccountRepository implements AccountRepository {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public boolean isProxyPublicKey(byte[] publicKey) throws DataException {
|
||||||
|
try {
|
||||||
|
return this.repository.exists("ProxyForgers", "proxy_public_key = ?", publicKey);
|
||||||
|
} catch (SQLException e) {
|
||||||
|
throw new DataException("Unable to check for proxy public key in repository", e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public List<ProxyForgerData> findProxyAccounts(List<String> recipients, List<String> forgers, Integer limit, Integer offset, Boolean reverse) throws DataException {
|
public List<ProxyForgerData> findProxyAccounts(List<String> recipients, List<String> forgers, Integer limit, Integer offset, Boolean reverse) throws DataException {
|
||||||
String sql = "SELECT forger, recipient, share, proxy_public_key FROM ProxyForgers ";
|
String sql = "SELECT forger, recipient, share, proxy_public_key FROM ProxyForgers ";
|
||||||
|
Loading…
x
Reference in New Issue
Block a user