From 6c61b39d81ea1181cf46de435d9be8c93f4d9160 Mon Sep 17 00:00:00 2001 From: soh_cah_toa Date: Wed, 5 Jun 2013 17:09:09 -0400 Subject: [PATCH] Changed 401 status to 403 in filter for non-permitted IP's. 403 Forbidden is more appropriate since 401 Unauthorized only indicates that authentication is needed. In the case of a bad IP, authentication will make no difference which is exactly what 403 is meant for. --- extensions/dns/rest/dns.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/dns/rest/dns.rb b/extensions/dns/rest/dns.rb index 5661e7bf7..251dae08a 100644 --- a/extensions/dns/rest/dns.rb +++ b/extensions/dns/rest/dns.rb @@ -15,8 +15,8 @@ module Dns config = BeEF::Core::Configuration.instance # Require a valid API token from a valid IP address - error 401 unless params[:token] == config.get('beef.api_token') - halt 401 unless BeEF::Core::Rest.permitted_source?(request.ip) + halt 401 unless params[:token] == config.get('beef.api_token') + halt 403 unless BeEF::Core::Rest.permitted_source?(request.ip) headers 'Content-Type' => 'application/json; charset=UTF-8', 'Pragma' => 'no-cache',