diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-10-30 20:19:23 +0100 |
|---|---|---|
| committer | Vincent Petry <pvince81@owncloud.com> | 2015-11-23 17:14:39 +0100 |
| commit | a57f153ad78a82c815d3789357f43053f23a42ce (patch) | |
| tree | 71cfaf1bfdd8e5568c50064c3e2deed905999d9d /lib/private/memcache | |
| parent | b2d9a3a08dbca7f5376c5dd65414f5a73671dbf2 (diff) | |
| download | nextcloud-server-a57f153ad78a82c815d3789357f43053f23a42ce.tar.gz nextcloud-server-a57f153ad78a82c815d3789357f43053f23a42ce.zip | |
Add support for Redis password auth
For enhanced security it is recommended to configure Redis to only accept connections with a password. (http://redis.io/topics/security)
This is especially critical since Redis supports the LUA scripting language and thus a simple SSRF vulnerability (as proven in http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ for example) may lead to a remote code execution.
Diffstat (limited to 'lib/private/memcache')
| -rw-r--r-- | lib/private/memcache/redis.php | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/private/memcache/redis.php b/lib/private/memcache/redis.php index 21477798059..83be662eabf 100644 --- a/lib/private/memcache/redis.php +++ b/lib/private/memcache/redis.php @@ -56,6 +56,9 @@ class Redis extends Cache implements IMemcache { } self::$cache->connect($host, $port, $timeout); + if(isset($config['password']) && $config['password'] !== '') { + self::$cache->auth($config['password']); + } if (isset($config['dbindex'])) { self::$cache->select($config['dbindex']); |