From 4f277524685477f2ae9887565798fdbd28675b6b Mon Sep 17 00:00:00 2001
From: Ethan Buchman <ethan@coinculture.info>
Date: Mon, 22 May 2017 07:51:14 -0400
Subject: [PATCH] [rpc] dont enable unsafe by default; limit /blockchain_info
 to 20 blocks

---
 rpc/core/blocks.go |  5 ++++-
 rpc/core/routes.go | 12 +++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/rpc/core/blocks.go b/rpc/core/blocks.go
index 4914fcb31..873b711d8 100644
--- a/rpc/core/blocks.go
+++ b/rpc/core/blocks.go
@@ -10,7 +10,7 @@ import (
 
 //-----------------------------------------------------------------------------
 
-// TODO: limit/permission on (max - min)
+// Returns at most 20 blocks
 func BlockchainInfo(minHeight, maxHeight int) (*ctypes.ResultBlockchainInfo, error) {
 	if maxHeight == 0 {
 		maxHeight = blockStore.Height()
@@ -19,7 +19,10 @@ func BlockchainInfo(minHeight, maxHeight int) (*ctypes.ResultBlockchainInfo, err
 	}
 	if minHeight == 0 {
 		minHeight = MaxInt(1, maxHeight-20)
+	} else {
+		minHeight = MaxInt(minHeight, maxHeight-20)
 	}
+
 	logger.Debug("BlockchainInfoHandler", "maxHeight", maxHeight, "minHeight", minHeight)
 
 	blockMetas := []*types.BlockMeta{}
diff --git a/rpc/core/routes.go b/rpc/core/routes.go
index 734d1ee77..795acde9b 100644
--- a/rpc/core/routes.go
+++ b/rpc/core/routes.go
@@ -31,13 +31,15 @@ var Routes = map[string]*rpc.RPCFunc{
 	// abci API
 	"abci_query": rpc.NewRPCFunc(ABCIQuery, "path,data,prove"),
 	"abci_info":  rpc.NewRPCFunc(ABCIInfo, ""),
+}
 
+func AddUnsafeRoutes() {
 	// control API
-	"dial_seeds":           rpc.NewRPCFunc(UnsafeDialSeeds, "seeds"),
-	"unsafe_flush_mempool": rpc.NewRPCFunc(UnsafeFlushMempool, ""),
+	Routes["dial_seeds"] = rpc.NewRPCFunc(UnsafeDialSeeds, "seeds")
+	Routes["unsafe_flush_mempool"] = rpc.NewRPCFunc(UnsafeFlushMempool, "")
 
 	// profiler API
-	"unsafe_start_cpu_profiler": rpc.NewRPCFunc(UnsafeStartCPUProfiler, "filename"),
-	"unsafe_stop_cpu_profiler":  rpc.NewRPCFunc(UnsafeStopCPUProfiler, ""),
-	"unsafe_write_heap_profile": rpc.NewRPCFunc(UnsafeWriteHeapProfile, "filename"),
+	Routes["unsafe_start_cpu_profiler"] = rpc.NewRPCFunc(UnsafeStartCPUProfiler, "filename")
+	Routes["unsafe_stop_cpu_profiler"] = rpc.NewRPCFunc(UnsafeStopCPUProfiler, "")
+	Routes["unsafe_write_heap_profile"] = rpc.NewRPCFunc(UnsafeWriteHeapProfile, "filename")
 }