Fixed adduserbatch validation.
Ylian Saint-Hilaire committed
Jun 21, 2020 at 22:33 UTC
0604d9f31df271234e6b4efddcc61d0e27ccef56
2 files changed
+34
-14
meshuser.js
+23
-13
@@ -1596,21 +1596,31 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1596
}
1597
case 'adduserbatch':
1598
{
1599
+ var err = null;
1600
+
1601
// Add many new user accounts
1600
- if ((user.siteadmin & 2) == 0) break;
1601
- if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) break;
1602
- if (!Array.isArray(command.users)) break;
1603
- var userCount = 0;
1604
- for (var i in command.users) {
1605
- if (domain.usernameisemail) { if (command.users[i].email) { command.users[i].user = command.users[i].email; } else { command.users[i].email = command.users[i].user; } } // If the email is the username, set this here.
1606
- if (common.validateUsername(command.users[i].user, 1, 256) == false) break; // Username is between 1 and 64 characters, no spaces
1607
- if ((command.users[i].user[0] == '~') || (command.users[i].user.indexOf('/') >= 0)) break; // This is a reserved user name or invalid name
1608
- if (common.validateString(command.users[i].pass, 1, 256) == false) break; // Password is between 1 and 256 characters
1609
- if (common.checkPasswordRequirements(command.users[i].pass, domain.passwordrequirements) == false) break; // Password does not meet requirements
1610
- if ((command.users[i].email != null) && (common.validateEmail(command.users[i].email, 1, 1024) == false)) break; // Check if this is a valid email address
1611
- userCount++;
1602
+ if ((user.siteadmin & 2) == 0) { err = 'Access denied'; }
1603
+ else if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { err = 'Unable to create users when in SSPI or LDAP mode'; }
1604
+ else if (!Array.isArray(command.users)) { err = 'Invalid users'; }
1605
+ else {
1606
+ var userCount = 0;
1607
+ for (var i in command.users) {
1608
+ if (domain.usernameisemail) { if (command.users[i].email) { command.users[i].user = command.users[i].email; } else { command.users[i].email = command.users[i].user; } } // If the email is the username, set this here.
1609
+ if (common.validateUsername(command.users[i].user, 1, 256) == false) { err = 'Invalid username'; break; } // Username is between 1 and 64 characters, no spaces
1610
+ if ((command.users[i].user[0] == '~') || (command.users[i].user.indexOf('/') >= 0)) { err = 'Invalid username'; break; } // This is a reserved user name or invalid name
1611
+ if (common.validateString(command.users[i].pass, 1, 256) == false) { err = 'Invalid password'; break; } // Password is between 1 and 256 characters
1612
+ if (common.checkPasswordRequirements(command.users[i].pass, domain.passwordrequirements) == false) { err = 'Invalid password'; break; } // Password does not meet requirements
1613
+ if ((command.users[i].email != null) && (common.validateEmail(command.users[i].email, 1, 1024) == false)) { err = 'Invalid email'; break; } // Check if this is a valid email address
1614
+ userCount++;
1615
+ }
1616
}
1613
-
1617
+
1618
+ // Handle any errors
1619
+ if (err != null) {
1620
+ if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'adduserbatch', responseid: command.responseid, result: err })); } catch (ex) { } }
1621
+ break;
1622
+ }
1623
+
1624
// Check if we exceed the maximum number of user accounts
1625
db.isMaxType(domain.limits.maxuseraccounts + userCount, 'user', domain.id, function (maxExceed) {
1626
if (maxExceed) {
webserver.js
+11
-1
@@ -2615,9 +2615,18 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2615
const domain = getDomain(req);
2616
if (domain == null) { parent.debug('web', 'handleMeScriptRequest: no domain'); res.sendStatus(404); return; }
2617
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
2618
-
2618
if ((obj.userAllowedIp != null) && (checkIpAddressEx(req, res, obj.userAllowedIp, false) === false)) { return; } // Check server-wide IP filter only.
2619
+
2620
+ // Get the user and check user rights
2621
+ var authUserid = null;
2622
+ if ((req.session != null) && (typeof req.session.userid == 'string')) { authUserid = req.session.userid; }
2623
+ if (authUserid == null) { res.sendStatus(401); return; }
2624
+ const user = obj.users[authUserid];
2625
+ if (user == null) { res.sendStatus(401); return; }
2626
+
2627
if ((req.query.type == 1) && (req.query.meshid != null)) {
2628
+ // Get the CIRA install script
2629
+ if (obj.IsMeshViewable(user, req.query.meshid) == false) { res.sendStatus(404); return; }
2630
obj.getCiraConfigurationScript(req.query.meshid, function (script) {
2631
if (script == null) { res.sendStatus(404); } else {
2632
try {
@@ -2630,6 +2639,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2639
}
2640
});
2641
} else if (req.query.type == 2) {
2642
+ // Get the CIRA cleanup script
2643
obj.getCiraCleanupScript(function (script) {
2644
if (script == null) { res.sendStatus(404); } else {
2645
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename="cira_cleanup.mescript"' });