server: Verify the UDP client list during token validation

1 files changed, 8 insertions, 2 deletions

diff --git a/src/main.c b/src/main.c
index 8d13d7c..e88ccae 100644
--- a/src/main.c
+++ b/src/main.c
@@ -123,12 +123,18 @@ stp_validate_fetch_token_from_query (GHashTable  *tokens,
 
   /* Only needed for RTP streaming */
   udp_clients = g_hash_table_lookup (query, "udp-clients");
-  if (!udp_clients) {
+  token->udp_clients = g_strdup (udp_clients);
+
+  if (!token->udp_clients) {
     *http_status_code = SOUP_STATUS_BAD_REQUEST;
     goto err;
   }
 
-  token->udp_clients = g_strdup (udp_clients);
+  if (!stp_clients_is_subset (perms_token->udp_clients,
+                              token->udp_clients)) {
+    *http_status_code = SOUP_STATUS_FORBIDDEN;
+    goto err;
+  }
 
 out:
   g_hash_table_destroy (query);