ParadoxAlarmInterface/pai
Use user code from panel to validate partition control messages
オープン
#142 opened on 2020/03/05
enhancementhelp wantedprotocol
Repository metrics
- Stars
- (414 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
With current implementation any of the client can send a partition control message to pai and easily disarm the system. From the overall system perspective it can lead to a vulnerability.
Disarming should be only possible if a user code is sent back as part of the payload. The sent user code should be validated against the user code(s) in the alarm panel. If the user code is found in the alarm panel the system should make the state change on behalf of the found user. In every other cases the request should be rejected.