add nice404 to invite and fix invite with dns use #6017
Signed-off-by: si458 <simonsmith5521@gmail.com>
Simon Smith committed
Apr 11, 2024 at 18:51 UTC
1da33f0ade2ec0a409f0d96063c3616029b49baf
1 file changed
+14
-4
webserver.js
+14
-4
@@ -2073,6 +2073,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2073
function handleInviteRequest(req, res) {
2074
const domain = getDomain(req);
2075
if (domain == null) { parent.debug('web', 'handleInviteRequest: failed checks.'); res.sendStatus(404); return; }
2076
+ if (domain.agentinvitecodes != true) { nice404(req, res); return; }
2077
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
2078
if ((req.body == null) || (req.body.inviteCode == null) || (req.body.inviteCode == '')) { render(req, res, getRenderPage('invite', req, domain), getRenderArgs({ messageid: 0 }, req, domain)); return; } // No invitation code
2079
@@ -6590,10 +6591,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6591
});
6592
});
6593
}
6593
- if (domain.agentinvitecodes == true) {
6594
- obj.app.get(url + 'invite', handleInviteRequest);
6595
- obj.app.post(url + 'invite', obj.bodyParser.urlencoded({ extended: false }), handleInviteRequest);
6596
- }
6594
+ obj.app.get(url + 'invite', handleInviteRequest);
6595
+ obj.app.post(url + 'invite', obj.bodyParser.urlencoded({ extended: false }), handleInviteRequest);
6596
+
6597
if (parent.pluginHandler != null) {
6598
obj.app.get(url + 'pluginadmin.ashx', obj.handlePluginAdminReq);
6599
obj.app.post(url + 'pluginadmin.ashx', obj.bodyParser.urlencoded({ extended: false }), obj.handlePluginAdminPostReq);
@@ -7117,6 +7117,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
7117
}
7118
}
7119
7120
+ function nice404(req, res) {
7121
+ parent.debug('web', '404 Error ' + req.url);
7122
+ var domain = getDomain(req);
7123
+ if ((domain == null) || (domain.auth == 'sspi')) { res.sendStatus(404); return; }
7124
+ if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL
7125
+ const cspNonce = obj.crypto.randomBytes(15).toString('base64');
7126
+ res.set({ 'Content-Security-Policy': "default-src 'none'; script-src 'self' 'nonce-" + cspNonce + "'; img-src 'self'; style-src 'self' 'nonce-" + cspNonce + "';" }); // This page supports very tight CSP policy
7127
+ res.status(404).render(getRenderPage((domain.sitestyle == 2) ? 'error4042' : 'error404', req, domain), getRenderArgs({ cspNonce: cspNonce }, req, domain));
7128
+ }
7129
+
7130
// Auth strategy flags
7131
const domainAuthStrategyConsts = {
7132
twitter: 1,