fix(runner): check token

semaphoreui · Jan 7, 2024 · 5596943 · 5596943
1 parent 1ae8eb1
commit 5596943
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/api/runners/runners.go b/api/runners/runners.go
@@ -13,6 +13,8 @@ import (
 func RunnerMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 
+		token := r.Header.Get("X-API-Token")
+
 		runnerID, err := helpers.GetIntParam("runner_id", w, r)
 
 		if err != nil {
@@ -26,6 +28,13 @@ func RunnerMiddleware(next http.Handler) http.Handler {
 
 		runner, err := store.GetGlobalRunner(runnerID)
 
+		if runner.Token != token {
+			helpers.WriteJSON(w, http.StatusUnauthorized, map[string]string{
+				"error": "Invalid token",
+			})
+			return
+		}
+
 		if err != nil {
 			helpers.WriteJSON(w, http.StatusNotFound, map[string]string{
 				"error": "Runner not found",