Removed code to create a login token from user/pass since it's not secure.
Ylian Saint-Hilaire committed
Jul 27, 2020 at 13:07 UTC
17c7b6989f62e84199d8793a9840d04f5999cc03
1 file changed
-26
webserver.js
-26
@@ -4944,32 +4944,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4944
});
4945
}
4946
4947
- // Creates a login token using the user/pass that is passed in as URL arguments.
4948
- // For example: https://localhost/createLoginToken.ashx?user=admin&pass=admin&a=3
4949
- // It's not advised to use this to create login tokens since the URL is often logged and you got credentials in the URL.
4950
- // Since it's bad, it's only offered when an untrusted certificate is used as a way to help developers get started.
4951
- if (obj.isTrustedCert() == false) {
4952
- obj.app.get(url + 'createLoginToken.ashx', function (req, res) {
4953
- // A web socket session can be authenticated in many ways (Default user, session, user/pass and cookie). Check authentication here.
4954
- if ((req.query.user != null) && (req.query.pass != null)) {
4955
- // A user/pass is provided in URL arguments
4956
- obj.authenticate(req.query.user, req.query.pass, getDomain(req), function (err, userid) {
4957
- if ((err == null) && (obj.users[userid])) {
4958
- // User is authenticated, create a token
4959
- var x = { a: 3 }; for (var i in req.query) { if ((i != 'user') && (i != 'pass')) { x[i] = obj.common.toNumber(req.query[i]); } } x.u = userid;
4960
- res.send(obj.parent.encodeCookie(x, obj.parent.loginCookieEncryptionKey));
4961
- } else {
4962
- res.sendStatus(404);
4963
- }
4964
- });
4965
- } else {
4966
- res.sendStatus(404);
4967
- }
4968
- });
4969
- }
4970
-
4971
- //obj.app.get(url + 'stop', function (req, res) { res.send('Stopping Server, <a href="' + url + '">click here to login</a>.'); setTimeout(function () { parent.Stop(); }, 500); });
4972
-
4947
// Indicates to ExpressJS that the override public folder should be used to serve static files.
4948
if (parent.config.domains[i].webpublicpath != null) {
4949
// Use domain public path