deny resetaccount pass change with external auth
Signed-off-by: Simon Smith <simonsmith5521@gmail.com>
Simon Smith committed
Sep 30, 2023 at 11:20 UTC
014e89ea8bea9c630bfd2c1aee9b8a766201c24a
1 file changed
+24
-12
meshcentral.js
+24
-12
@@ -854,7 +854,7 @@ function CreateMeshCentralServer(config, args) {
854
return;
855
}
856
if (obj.args.resetaccount) { // Unlock a user account, set a new password and remove 2FA
857
- if ((typeof obj.args.resetaccount != 'string') || ((obj.args.pass == null) && (obj.args.hashpass == null)) || (obj.args.pass == '') || (obj.args.hashpass == '') || (obj.args.resetaccount.indexOf(' ') >= 0)) { console.log("Usage: --resetaccount [userid] --domain (domain) --pass [password]."); process.exit(); return; }
857
+ if ((typeof obj.args.resetaccount != 'string') || (obj.args.resetaccount.indexOf(' ') >= 0)) { console.log("Usage: --resetaccount [userid] --domain (domain) --pass [password]."); process.exit(); return; }
858
var userid = 'user/' + (obj.args.domain ? obj.args.domain : '') + '/' + obj.args.resetaccount.toLowerCase();
859
if (obj.args.resetaccount.startsWith('user/')) { userid = obj.args.resetaccount; }
860
if (userid.split('/').length != 3) { console.log("Invalid userid."); process.exit(); return; }
@@ -863,17 +863,29 @@ function CreateMeshCentralServer(config, args) {
863
if ((docs == null) || (docs.length == 0)) { console.log("Unknown userid, usage: --resetaccount [userid] --domain (domain) --pass [password]."); process.exit(); return; }
864
const user = docs[0]; if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { user.siteadmin -= 32; } // Unlock the account.
865
delete user.phone; delete user.otpekey; delete user.otpsecret; delete user.otpkeys; delete user.otphkeys; delete user.otpdev; delete user.otpsms; delete user.otpmsg; // Disable 2FA
866
- delete user.msghandle; // Disable users 2fa messaging too
867
- if (obj.args.hashpass) {
868
- // Reset an account using a pre-hashed password. Use --hashpassword to pre-hash a password.
869
- var hashpasssplit = obj.args.hashpass.split(',');
870
- if (hashpasssplit.length != 2) { console.log("Invalid hashed password."); process.exit(); return; }
871
- user.salt = hashpasssplit[0];
872
- user.hash = hashpasssplit[1];
873
- obj.db.Set(user, function () { console.log("Done. This command will only work if MeshCentral is stopped."); process.exit(); return; });
874
- } else {
875
- // Hash the password and reset the account.
876
- require('./pass').hash(String(obj.args.pass), user.salt, function (err, hash, tag) { if (err) { console.log("Unable to reset password: " + err); process.exit(); return; } user.hash = hash; obj.db.Set(user, function () { console.log("Done."); process.exit(); return; }); }, 0);
866
+ delete user.msghandle; // Disable users 2fa messaging toovar config = getConfig(false);
867
+ if(config.domains[user.domain].auth || config.domains[user.domain].authstrategies){
868
+ console.log('This users domain has external authentication methods enabled so the password will not be changed if you set one')
869
+ obj.db.Set(user, function () { console.log("Done."); process.exit(); return; });
870
+ }else{
871
+ if (obj.args.hashpass && (typeof obj.args.hashpass == 'string')) {
872
+ // Reset an account using a pre-hashed password. Use --hashpassword to pre-hash a password.
873
+ var hashpasssplit = obj.args.hashpass.split(',');
874
+ if (hashpasssplit.length != 2) { console.log("Invalid hashed password."); process.exit(); return; }
875
+ user.salt = hashpasssplit[0];
876
+ user.hash = hashpasssplit[1];
877
+ obj.db.Set(user, function () { console.log("Done. This command will only work if MeshCentral is stopped."); process.exit(); return; });
878
+ } else if(obj.args.pass && (typeof obj.args.pass == 'string')) {
879
+ // Hash the password and reset the account.
880
+ require('./pass').hash(String(obj.args.pass), user.salt, function (err, hash, tag) {
881
+ if (err) { console.log("Unable to reset password: " + err); process.exit(); return; }
882
+ user.hash = hash;
883
+ obj.db.Set(user, function () { console.log("Done."); process.exit(); return; });
884
+ }, 0);
885
+ }else{
886
+ console.log('Not setting a users password');
887
+ obj.db.Set(user, function () { console.log("Done."); process.exit(); return; });
888
+ }
889
}
890
});
891
return;