Fixed session IP check still being performed when CookieIpCheck is false.
Ylian Saint-Hilaire committed
Feb 24, 2022 at 12:22 UTC
15e1718296a7940b68894d87bc2c46c98e629d83
2 files changed
+5
-5
certoperations.js
+1
-1
@@ -233,7 +233,7 @@ module.exports.CertificateOperations = function (parent) {
233
234
// Compute the SHA256 and SHA1 hashes of the root certificate
235
for (var k in r.certs) {
236
- if (r.certs[k].subject.hash != r.certs[k].issuer.hash) { amtacmactivation.acmCertErrors.push("Invalid Intel AMT ACM certificate chain."); continue; }
236
+ if (r.certs[k].subject.hash != r.certs[k].issuer.hash) continue;
237
const certdata = obj.forge.asn1.toDer(obj.pki.certificateToAsn1(r.certs[k])).data;
238
var md = obj.forge.md.sha256.create();
239
md.update(certdata);
webserver.js
+4
-4
@@ -1140,7 +1140,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
1140
var maxCookieAge = domain.twofactorcookiedurationdays;
1141
if (typeof maxCookieAge != 'number') { maxCookieAge = 30; }
1142
const twoFactorCookie = obj.parent.encodeCookie({ userid: user._id, expire: maxCookieAge * 24 * 60 /*, ip: req.clientIp*/ }, obj.parent.loginCookieEncryptionKey);
1143
- res.cookie('twofactor', twoFactorCookie, { maxAge: (maxCookieAge * 24 * 60 * 60 * 1000), httpOnly: true, sameSite: 'strict', secure: true });
1143
+ res.cookie('twofactor', twoFactorCookie, { maxAge: (maxCookieAge * 24 * 60 * 60 * 1000), httpOnly: true, sameSite: ((parent.config.settings.cookieipcheck === false) ? 'none' : 'strict'), secure: true });
1144
}
1145
1146
// Check if email address needs to be confirmed
@@ -3024,7 +3024,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
3024
var maxCookieAge = domain.twofactorcookiedurationdays;
3025
if (typeof maxCookieAge != 'number') { maxCookieAge = 30; }
3026
const twoFactorCookie = obj.parent.encodeCookie({ userid: cookie.u, expire: maxCookieAge * 24 * 60 /*, ip: req.clientIp*/ }, obj.parent.loginCookieEncryptionKey);
3027
- res.cookie('twofactor', twoFactorCookie, { maxAge: (maxCookieAge * 24 * 60 * 60 * 1000), httpOnly: true, sameSite: 'strict', secure: true });
3027
+ res.cookie('twofactor', twoFactorCookie, { maxAge: (maxCookieAge * 24 * 60 * 60 * 1000), httpOnly: true, sameSite: ((parent.config.settings.cookieipcheck === false) ? 'none' : 'strict'), secure: true });
3028
}
3029
3030
handleRootRequestEx(req, res, domain);
@@ -5629,7 +5629,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5629
keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances
5630
secure: (obj.args.tlsoffload == null) // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)
5631
}
5632
- if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; } else { sessionOptions.sameSite = 'strict'; }
5632
+ if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; } else { sessionOptions.sameSite = ((parent.config.settings.cookieipcheck === false) ? 'none' : 'strict'); }
5633
if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }
5634
obj.app.use(obj.session(sessionOptions));
5635
@@ -5763,7 +5763,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
5763
}
5764
5765
// Check the session if bound to the external IP address
5766
- if ((req.session.ip != null) && (req.clientIp != null) && (req.session.ip != req.clientIp)) { req.session = {}; }
5766
+ if ((parent.config.settings.cookieipcheck !== false) && (req.session.ip != null) && (req.clientIp != null) && (req.session.ip != req.clientIp)) { req.session = {}; }
5767
5768
// Extend the session time by forcing a change to the session every minute.
5769
if (req.session.userid != null) { req.session.t = Math.floor(Date.now() / 60e3); } else { delete req.session.t; }