MySmartHome/MySensors
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent SecureActuator from accepting ACKs as commands

Browse Source 
As ACKs are not currently signed, allowing ACKs as commands
is a considerable security hole for this sketch. This is now resolved.
This commit is contained in:
Patrick Fallberg
2015-12-16 10:54:05 +01:00
parent ca4358591d
commit 62f522a065
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libraries/MySensors/examples/SecureActuator/SecureActuator.ino
+2 -1
View File
@@ -111,7 +111,8 @@ void loop()
*/ */
void receive(const MyMessage &message) { void receive(const MyMessage &message) {
// We only expect one type of message from controller. But we better check anyway. // We only expect one type of message from controller. But we better check anyway.
if (message.type==V_LOCK_STATUS && message.sensor<=NOF_LOCKS) { // And acks are not accepted as control messages
if (message.type==V_LOCK_STATUS && message.sensor<=NOF_LOCKS && !mGetAck(message)) {
// Change relay state // Change relay state
digitalWrite(message.sensor-1+LOCK_1, message.getBool()?LOCK_LOCK:LOCK_UNLOCK); digitalWrite(message.sensor-1+LOCK_1, message.getBool()?LOCK_LOCK:LOCK_UNLOCK);
// Store state in eeprom // Store state in eeprom