2 Dec
2004
2 Dec
'04
6:37 p.m.
kcassidy(a)kakelma.mine.nu wrote:
But we can still hijack someone who is registered
right?
Don't think so. If you use A's authorization credentials and B's
username (which is inserted into From, isn't it?), then the INVITE would
pass the proxy_authorization(), but will fail to satisfy check_from()
which checks AFAIR the From-user against the username in credentials.
The same applies to REGISTERs, if you check_to() after successfully
passing www_authorize().
Don't know about check_xxx() and Radius, we don't use Radius here.
Andy