Added more input validation to --resetaccount and --adminaccount.
Ylian Saint-Hilaire committed
Mar 23, 2020 at 13:32 UTC
069da0d9a82a33638bf8be185baa8bab88d22c41
1 file changed
+2
-2
meshcentral.js
+2
-2
@@ -608,7 +608,7 @@ function CreateMeshCentralServer(config, args) {
608
if (obj.args.recordencryptionrecode) { obj.db.performRecordEncryptionRecode(function (count) { console.log('Re-encoded ' + count + ' record(s).'); process.exit(); }); return; }
609
if (obj.args.dbstats) { obj.db.getDbStats(function (stats) { console.log(stats); process.exit(); }); return; }
610
if (obj.args.resetaccount) {
611
- if (obj.args.pass == null) { console.log('Usage: --resetaccount [userid] --pass [password].'); process.exit(); return; }
611
+ if ((obj.args.pass == null) || (obj.args.pass == '') || (obj.args.resetaccount.startsWith('user/') == false)) { console.log('Usage: --resetaccount [userid] --pass [password].'); process.exit(); return; }
612
obj.db.Get(obj.args.resetaccount, function (err, docs) {
613
if ((err != null) || (docs == null) || (docs.length == 0)) { console.log('Unknown userid, usage: --resetaccount [userid] --pass [password].'); process.exit(); return; }
614
var user = docs[0]; if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { user.siteadmin -= 32; } // Unlock the account.
@@ -617,7 +617,7 @@ function CreateMeshCentralServer(config, args) {
617
});
618
return;
619
}
620
- if (obj.args.adminaccount) {
620
+ if (obj.args.adminaccount || (obj.args.resetaccount.startsWith('user/') == false)) {
621
obj.db.Get(obj.args.adminaccount, function (err, docs) {
622
if ((err != null) || (docs == null) || (docs.length == 0)) { console.log('Unknown userid, usage: --adminaccount [userid].'); process.exit(); return; }
623
docs[0].siteadmin = 0xFFFFFFFF; // Set user as site administrator