--- a/src/goodjava/lucene/backup/BackupServer.java	Mon Jun 27 18:36:56 2022 -0600
+++ b/src/goodjava/lucene/backup/BackupServer.java	Mon Jun 27 20:51:49 2022 -0600
@@ -122,6 +122,15 @@
 			} else if( backup != null ) {
 				backup.handle(rpc,call);
 			} else if( call.cmd.equals("copy") ) {
+				try {
+					if( !IoUtils.getInetAddresses().contains(rpc.socket.getInetAddress()) ) {
+						rpc.write( new RpcException("only localhost allowed") );
+						rpc.close();
+						return;
+					}
+				} catch(IOException e) {
+					throw new RuntimeException(e);
+				}
 				String dirName = (String)call.args[0];
 				copy(new File(dirName));
 				rpc.write(Rpc.OK);