我把给 JSON-RPC 加密码的修改传到 SVN 了。如果你搭好了编译环境，请帮忙测试。
I uploaded to SVN my changes to add a password to JSON-RPC. If you're set up to build, please test it.
-server 开关被 -rpcpw=<password> 取代，bitcoind 也用它。
The -server switch is replaced with -rpcpw=<password>, which is also used with bitcoind.
bitcoin -rpcpw=<password> -- 带开放的 JSON-RPC 端口运行
bitcoin -rpcpw=<password> -- runs with JSON-RPC port open
bitcoind -rpcpw=<password> -- 带密码的守护进程
bitcoind -rpcpw=<password> -- daemon with password
如果你对开关的名字有更好的想法，告诉我，但请记住将来数据库加密也需要一个密码。我不确定，但我想用户可能会希望为这两种用途设置不同的密码。
If you have a better idea for the switch name, let me know, but keep in mind there will eventually be a password for encrypting the database too. I'm not sure but I think they may want to use different passwords for the two.
不设密码的话会给出警告。
It gives a warning if you don't set a password.
现在所有命令都要把密码作为第一个参数。运行 "bitcoind help" 会告诉你这一点。
All commands now require the password as the first parameter. It'll tell you that if you run "bitcoind help".
核心代码：
The central code:
// Check password
// Check password
if (params.size() < 1 || params[0].type() != str_type)
throw runtime_error("First parameter must be the password.");
if (params[0].get_str() != strRPCPassword)
{
if (strRPCPassword.size() < 15)
Sleep(50);
begin = strRequest.end();
printf("ThreadRPCServer incorrect password attempt
");
throw runtime_error("Incorrect password.");
}对这些决定有什么意见吗？
Any comments on these decisions?
1) if (strRPCPassword.size() < 15) Sleep(50); -- 意思是密码短的话，每次尝试之后等 50ms。这可能被用来做 DoS 攻击，但我想如果密码短，更重要的是防暴力密码扫描。这可能让外人得知密码不足 15 个字符，但不足 15 也不算什么值得注意的信息，大多数密码都不到 15。如果你想封死 DoS 的可能，用 15 个字符或更长的密码就是。
1) if (strRPCPassword.size() < 15) Sleep(50); -- this means if it's a short password, it'll wait 50ms after each attempt. This might be used as a DoS attack, but I figured if it's a short password, it's more important to protect against brute force password scan. This may tell outsiders whether the password is less than 15 characters, but less than 15 isn't all that noteworthy, most passwords are less than 15. If you want to close the DoS possibility, just use a password 15 characters or longer.
2) begin = strRequest.end(); -- 如果是单个请求携带多个调用，只要有一个密码错误，我就把剩下的全部丢弃。这样就不能在一个包里塞进上百万次密码尝试。你们觉得这样做对吗？（多次调用可能本来就几乎不会用到）
2) begin = strRequest.end(); -- if it's a single request with multiple invocations, I throw away the rest if one has a bad password. This is so you can't stuff it with millions of password attempts in one packet. What do you think, is this the right thing to do? (multiple invocation is probably almost never used anyway)
我还修了帮助里列出的两个重复命令：
I also fixed the two duplicated commands listed in the help:
getaddressesbylabel
getaddressesbylabel
getbalance
getbalance
getblockcount
getblockcount
getblocknumber
getblocknumber
getconnectioncount
getconnectioncount
getdifficulty
getdifficulty
getgenerate
getgenerate
getinfo
getinfo
getlabel
getlabel
getnewaddress
getnewaddress
getreceivedbyaddress
getreceivedbyaddress
getreceivedbylabel
getreceivedbylabel
help
help
listreceivedbyaddress
listreceivedbyaddress
listreceivedbylabel
listreceivedbylabel
sendtoaddress
sendtoaddress
setgenerate
setgenerate
setlabel
setlabel
stop
stop
当前版本尚未建立逐条校对状态记录。来源核验、历史审校与当前译文校对是不同事项。
译文内容版本：3926670a8dc4。用于比对文本，不代表校对等级或更新时间。
请填写对应原文、现译文、建议译法和理由。复制后通过你联系本站作者的渠道提交；此处不会自动发送。