fix web-rdp/web-ssh save creds per user
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
May 24, 2024 at 17:27 UTC
26ac23c80df7c2830947eb6c7904b16076c3d4ec
3 files changed
+29
-21
meshcentral-config-schema.json
+1
-1
@@ -1754,7 +1754,7 @@
1754
},
1755
"mstsc": {
1756
"type": "boolean",
1757
- "default": false,
1757
+ "default": true,
1758
"description": "When enabled, activates the built-in web-based RDP client."
1759
},
1760
"ssh": {
sample-config-advanced.json
+1
-1
@@ -318,7 +318,7 @@
318
"_geoLocation": true,
319
"_ipLocation": true,
320
"_novnc": false,
321
- "_mstsc": true,
321
+ "_mstsc": false,
322
"_ssh": true,
323
"_WebEmailsPath": "/myserver/email-templates",
324
"_consentMessages": {
webserver.js
+27
-19
@@ -2105,6 +2105,24 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2105
var features = 0;
2106
if (domain.allowsavingdevicecredentials === false) { features |= 1; }
2107
2108
+ // Get the logged in user if present
2109
+ var user = null;
2110
+
2111
+ // If there is a login token, use that
2112
+ if (req.query.login != null) {
2113
+ var ucookie = parent.decodeCookie(req.query.login, parent.loginCookieEncryptionKey, 60); // Cookie with 1 hour timeout
2114
+ if ((ucookie != null) && (ucookie.a === 3) && (typeof ucookie.u == 'string')) { user = obj.users[ucookie.u]; }
2115
+ }
2116
+
2117
+ // If no token, see if we have an active session
2118
+ if ((user == null) && (req.session.userid != null)) { user = obj.users[req.session.userid]; }
2119
+
2120
+ // If still no user, see if we have a default user
2121
+ if ((user == null) && (obj.args.user)) { user = obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()]; }
2122
+
2123
+ // No user login, exit now
2124
+ if (user == null) { res.sendStatus(401); return; }
2125
+
2126
if (req.query.ws != null) {
2127
// This is a query with a websocket relay cookie, check that the cookie is valid and use it.
2128
var rcookie = parent.decodeCookie(req.query.ws, parent.loginCookieEncryptionKey, 60); // Cookie with 1 hour timeout
@@ -2122,8 +2140,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2140
if ((typeof node.ssh == 'object') && (typeof node.ssh.u == 'string') && (typeof node.ssh.p == 'string')) { serverCredentials = 1; } // Username and password
2141
else if ((typeof node.ssh == 'object') && (typeof node.ssh.k == 'string') && (typeof node.ssh.kp == 'string')) { serverCredentials = 2; } // Username, key and password
2142
else if ((typeof node.ssh == 'object') && (typeof node.ssh.k == 'string')) { serverCredentials = 3; } // Username and key. No password.
2143
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].u == 'string') && (typeof node.ssh[user._id].p == 'string')) { serverCredentials = 1; } // Username and password in per user format
2144
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].k == 'string') && (typeof node.ssh[user._id].kp == 'string')) { serverCredentials = 2; } // Username, key and password in per user format
2145
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].k == 'string')) { serverCredentials = 3; } // Username and key. No password. in per user format
2146
} else {
2126
- if ((typeof node.rdp == 'object') && (typeof node.rdp.d == 'string') && (typeof node.rdp.u == 'string') && (typeof node.rdp.p == 'string')) { serverCredentials = 1; } // Username and password
2147
+ if ((typeof node.rdp == 'object') && (typeof node.rdp.d == 'string') && (typeof node.rdp.u == 'string') && (typeof node.rdp.p == 'string')) { serverCredentials = 1; } // Username and password in legacy format
2148
+ if ((typeof node.rdp == 'object') && (typeof node.rdp[user._id] == 'object') && (typeof node.rdp[user._id].d == 'string') && (typeof node.rdp[user._id].u == 'string') && (typeof node.rdp[user._id].p == 'string')) { serverCredentials = 1; } // Username and password in per user format
2149
}
2150
}
2151
@@ -2134,24 +2156,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2156
}
2157
}
2158
2137
- // Get the logged in user if present
2138
- var user = null;
2139
-
2140
- // If there is a login token, use that
2141
- if (req.query.login != null) {
2142
- var ucookie = parent.decodeCookie(req.query.login, parent.loginCookieEncryptionKey, 60); // Cookie with 1 hour timeout
2143
- if ((ucookie != null) && (ucookie.a === 3) && (typeof ucookie.u == 'string')) { user = obj.users[ucookie.u]; }
2144
- }
2145
-
2146
- // If no token, see if we have an active session
2147
- if ((user == null) && (req.session.userid != null)) { user = obj.users[req.session.userid]; }
2148
-
2149
- // If still no user, see if we have a default user
2150
- if ((user == null) && (obj.args.user)) { user = obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()]; }
2151
-
2152
- // No user login, exit now
2153
- if (user == null) { res.sendStatus(401); return; }
2154
-
2159
// Check the nodeid
2160
if (req.query.node != null) {
2161
var nodeidsplit = req.query.node.split('/');
@@ -2187,6 +2191,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2191
if ((typeof node.ssh == 'object') && (typeof node.ssh.u == 'string') && (typeof node.ssh.p == 'string')) { serverCredentials = 1; } // Username and password
2192
else if ((typeof node.ssh == 'object') && (typeof node.ssh.k == 'string') && (typeof node.ssh.kp == 'string')) { serverCredentials = 2; } // Username, key and password
2193
else if ((typeof node.ssh == 'object') && (typeof node.ssh.k == 'string')) { serverCredentials = 3; } // Username and key. No password.
2194
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].u == 'string') && (typeof node.ssh[user._id].p == 'string')) { serverCredentials = 1; } // Username and password in per user format
2195
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].k == 'string') && (typeof node.ssh[user._id].kp == 'string')) { serverCredentials = 2; } // Username, key and password in per user format
2196
+ else if ((typeof node.ssh == 'object') && (typeof node.ssh[user._id] == 'object') && (typeof node.ssh[user._id].k == 'string')) { serverCredentials = 3; } // Username and key. No password. in per user format
2197
}
2198
} else {
2199
// RDP port
@@ -2196,6 +2203,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2203
// Check if we have RDP credentials for this device
2204
if (domain.allowsavingdevicecredentials !== false) {
2205
if ((typeof node.rdp == 'object') && (typeof node.rdp.d == 'string') && (typeof node.rdp.u == 'string') && (typeof node.rdp.p == 'string')) { serverCredentials = 1; } // Username and password
2206
+ if ((typeof node.rdp == 'object') && (typeof node.rdp[user._id] == 'object') && (typeof node.rdp[user._id].d == 'string') && (typeof node.rdp[user._id].u == 'string') && (typeof node.rdp[user._id].p == 'string')) { serverCredentials = 1; } // Username and password in per user format
2207
}
2208
}
2209
if (req.query.port != null) { var qport = 0; try { qport = parseInt(req.query.port); } catch (ex) { } if ((typeof qport == 'number') && (qport > 0) && (qport < 65536)) { port = qport; } }