Transaction

j"1LAnZuoQdcKCkpDBKQMCgziGMoPC4VQUckM <div class="post">I uploaded to SVN my changes to add a password to JSON-RPC. &nbsp;If you're set up to build, please test it.<br/><br/>The -server switch is replaced with -rpcpw=&lt;password&gt;, which is also used with bitcoind.<br/>bitcoin -rpcpw=&lt;password&gt; &nbsp; &nbsp;-- runs with JSON-RPC port open<br/>bitcoind -rpcpw=&lt;password&gt; &nbsp; -- daemon with password<br/><br/>If you have a better idea for the switch name, let me know, but keep in mind there will eventually be a password for encrypting the database too.&nbsp; I'm not sure but I think they may want to use different passwords for the two.<br/><br/>It gives a warning if you don't set a password.<br/><br/>All commands now require the password as the first parameter. &nbsp;It'll tell you that if you run "bitcoind help".<br/><br/>The central code:<br/><br/>&nbsp;&nbsp;// Check password<br/>&nbsp;&nbsp;if (params.size() &lt; 1 || params[0].type() != str_type)<br/>&nbsp;&nbsp; &nbsp; &nbsp;throw runtime_error("First parameter must be the password.");<br/>&nbsp;&nbsp;if (params[0].get_str() != strRPCPassword)<br/>&nbsp;&nbsp;{<br/>&nbsp;&nbsp; &nbsp; &nbsp;if (strRPCPassword.size() &lt; 15)<br/>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Sleep(50);<br/>&nbsp;&nbsp; &nbsp; &nbsp;begin = strRequest.end();<br/>&nbsp;&nbsp; &nbsp; &nbsp;printf("ThreadRPCServer incorrect password attempt ");<br/>&nbsp;&nbsp; &nbsp; &nbsp;throw runtime_error("Incorrect password.");<br/>&nbsp;&nbsp;}<br/><br/>Any comments on these decisions?<br/><br/>1) if (strRPCPassword.size() &lt; 15) Sleep(50); &nbsp;-- this means if it's a short password, it'll wait 50ms after each attempt. &nbsp;This might be used as a DoS attack, but I figured if it's a short password, it's more important to protect against brute force password scan. &nbsp;This may tell outsiders whether the password is less than 15 characters, but less than 15 isn't all that noteworthy, most passwords are less than 15. &nbsp;If you want to close the DoS possibility, just use a password 15 characters or longer.<br/><br/>2) begin = strRequest.end(); &nbsp;-- if it's a single request with multiple invocations, I throw away the rest if one has a bad password. &nbsp;This is so you can't stuff it with millions of password attempts in one packet. &nbsp;What do you think, is this the right thing to do? &nbsp;(multiple invocation is probably almost never used anyway)<br/><br/>I also fixed the two duplicated commands listed in the help:<br/><br/>getaddressesbylabel &lt;pw&gt; &lt;label&gt;<br/>getbalance &lt;pw&gt;<br/>getblockcount &lt;pw&gt;<br/>getblocknumber &lt;pw&gt;<br/>getconnectioncount &lt;pw&gt;<br/>getdifficulty &lt;pw&gt;<br/>getgenerate &lt;pw&gt;<br/>getinfo &lt;pw&gt;<br/>getlabel &lt;pw&gt; &lt;bitcoinaddress&gt;<br/>getnewaddress &lt;pw&gt; [label]<br/>getreceivedbyaddress &lt;pw&gt; &lt;bitcoinaddress&gt; [minconf=1]<br/>getreceivedbylabel &lt;pw&gt; &lt;label&gt; [minconf=1]<br/>help &lt;pw&gt;<br/>listreceivedbyaddress &lt;pw&gt; [minconf=1] [includeempty=false]<br/>listreceivedbylabel &lt;pw&gt; [minconf=1] [includeempty=false]<br/>sendtoaddress &lt;pw&gt; &lt;bitcoinaddress&gt; &lt;amount&gt; [comment] [comment-to]<br/>setgenerate &lt;pw&gt; &lt;generate&gt; [genproclimit]<br/>setlabel &lt;pw&gt; &lt;bitcoinaddress&gt; &lt;label&gt;<br/>stop &lt;pw&gt;<br/></div> text/html