From 4e90ad04d59751d427137f7dd1e5681bec263e19 Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Thu, 8 Mar 2018 10:09:56 +0000
Subject: [PATCH] serve restic: only accept v2 API requests for list

---
 cmd/serve/restic/restic.go | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/cmd/serve/restic/restic.go b/cmd/serve/restic/restic.go
index 7e2f697f1..8ed9626e3 100644
--- a/cmd/serve/restic/restic.go
+++ b/cmd/serve/restic/restic.go
@@ -143,6 +143,10 @@ these **must** end with /.  Eg
 	},
 }
 
+const (
+	resticAPIV2 = "application/vnd.x.restic.rest.v2"
+)
+
 // server contains everything to run the server
 type server struct {
 	f   fs.Fs
@@ -362,6 +366,12 @@ func (ls *listItems) add(entry fs.DirEntry) {
 func (s *server) listObjects(w http.ResponseWriter, r *http.Request, remote string) {
 	fs.Debugf(remote, "list request")
 
+	if r.Header.Get("Accept") != resticAPIV2 {
+		fs.Errorf(remote, "Restic v2 API required")
+		http.Error(w, "Restic v2 API required", http.StatusBadRequest)
+		return
+	}
+
 	// make sure an empty list is returned, and not a 'nil' value
 	ls := listItems{}