Prevent SecureActuator from accepting ACKs as commands
As ACKs are not currently signed, allowing ACKs as commands is a considerable security hole for this sketch. This is now resolved.
This commit is contained in:
@@ -111,7 +111,8 @@ void loop()
|
||||
*/
|
||||
void receive(const MyMessage &message) {
|
||||
// We only expect one type of message from controller. But we better check anyway.
|
||||
if (message.type==V_LOCK_STATUS && message.sensor<=NOF_LOCKS) {
|
||||
// And acks are not accepted as control messages
|
||||
if (message.type==V_LOCK_STATUS && message.sensor<=NOF_LOCKS && !mGetAck(message)) {
|
||||
// Change relay state
|
||||
digitalWrite(message.sensor-1+LOCK_1, message.getBool()?LOCK_LOCK:LOCK_UNLOCK);
|
||||
// Store state in eeprom
|
||||
|
||||
Reference in New Issue
Block a user