Tools not allowed to connect when account twas notools site rights, #2726
Ylian Saint-Hilaire committed
Jun 4, 2021 at 12:46 UTC
26f289aba710c5dbd3264f54abb37e9ef4f204da
2 files changed
+52
-16
agents/MeshCentralRouter.exe
Binary files a/agents/MeshCentralRouter.exe and b/agents/MeshCentralRouter.exe differ
webserver.js
+52
-16
@@ -86,22 +86,42 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
86
obj.renderLanguages = [];
87
88
// Mesh Rights
89
- const MESHRIGHT_EDITMESH = 1;
90
- const MESHRIGHT_MANAGEUSERS = 2;
91
- const MESHRIGHT_MANAGECOMPUTERS = 4;
92
- const MESHRIGHT_REMOTECONTROL = 8;
93
- const MESHRIGHT_AGENTCONSOLE = 16;
94
- const MESHRIGHT_SERVERFILES = 32;
95
- const MESHRIGHT_WAKEDEVICE = 64;
96
- const MESHRIGHT_SETNOTES = 128;
97
-
98
- // Site rights
99
- const SITERIGHT_SERVERBACKUP = 1;
100
- const SITERIGHT_MANAGEUSERS = 2;
101
- const SITERIGHT_SERVERRESTORE = 4;
102
- const SITERIGHT_FILEACCESS = 8;
103
- const SITERIGHT_SERVERUPDATE = 16;
104
- const SITERIGHT_LOCKED = 32;
89
+ const MESHRIGHT_EDITMESH = 0x00000001;
90
+ const MESHRIGHT_MANAGEUSERS = 0x00000002;
91
+ const MESHRIGHT_MANAGECOMPUTERS = 0x00000004;
92
+ const MESHRIGHT_REMOTECONTROL = 0x00000008;
93
+ const MESHRIGHT_AGENTCONSOLE = 0x00000010;
94
+ const MESHRIGHT_SERVERFILES = 0x00000020;
95
+ const MESHRIGHT_WAKEDEVICE = 0x00000040;
96
+ const MESHRIGHT_SETNOTES = 0x00000080;
97
+ const MESHRIGHT_REMOTEVIEWONLY = 0x00000100;
98
+ const MESHRIGHT_NOTERMINAL = 0x00000200;
99
+ const MESHRIGHT_NOFILES = 0x00000400;
100
+ const MESHRIGHT_NOAMT = 0x00000800;
101
+ const MESHRIGHT_DESKLIMITEDINPUT = 0x00001000;
102
+ const MESHRIGHT_LIMITEVENTS = 0x00002000;
103
+ const MESHRIGHT_CHATNOTIFY = 0x00004000;
104
+ const MESHRIGHT_UNINSTALL = 0x00008000;
105
+ const MESHRIGHT_NODESKTOP = 0x00010000;
106
+ const MESHRIGHT_REMOTECOMMAND = 0x00020000;
107
+ const MESHRIGHT_RESETOFF = 0x00040000;
108
+ const MESHRIGHT_GUESTSHARING = 0x00080000;
109
+ const MESHRIGHT_ADMIN = 0xFFFFFFFF;
110
+
111
+ // Site rights
112
+ const SITERIGHT_SERVERBACKUP = 0x00000001;
113
+ const SITERIGHT_MANAGEUSERS = 0x00000002;
114
+ const SITERIGHT_SERVERRESTORE = 0x00000004;
115
+ const SITERIGHT_FILEACCESS = 0x00000008;
116
+ const SITERIGHT_SERVERUPDATE = 0x00000010;
117
+ const SITERIGHT_LOCKED = 0x00000020;
118
+ const SITERIGHT_NONEWGROUPS = 0x00000040;
119
+ const SITERIGHT_NOMESHCMD = 0x00000080;
120
+ const SITERIGHT_USERGROUPS = 0x00000100;
121
+ const SITERIGHT_RECORDINGS = 0x00000200;
122
+ const SITERIGHT_LOCKSETTINGS = 0x00000400;
123
+ const SITERIGHT_ALLEVENTS = 0x00000800;
124
+ const SITERIGHT_ADMIN = 0xFFFFFFFF;
125
126
// Setup SSPI authentication if needed
127
if ((obj.parent.platform == 'win32') && (obj.args.nousers != true) && (obj.parent.config != null) && (obj.parent.config.domains != null)) {
@@ -6233,6 +6253,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6253
// A user/pass is provided in URL arguments
6254
obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) {
6255
6256
+ // Check if user as the "notools" site right. If so, deny this connection as tools are not allowed to connect.
6257
+ if ((user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & SITERIGHT_NOMESHCMD)) {
6258
+ // No tools allowed, close the websocket connection
6259
+ parent.debug('web', 'ERR: Websocket no tools allowed');
6260
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'notools', msg: 'notools' })); ws.close(); } catch (e) { }
6261
+ return;
6262
+ }
6263
+
6264
// See if we support two-factor trusted cookies
6265
var twoFactorCookieDays = 30;
6266
if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
@@ -6349,6 +6377,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
6377
obj.authenticate(s[0], s[1], domain, function (err, userid, passhint, loginOptions) {
6378
var user = obj.users[userid];
6379
if ((err == null) && (user)) {
6380
+ // Check if user as the "notools" site right. If so, deny this connection as tools are not allowed to connect.
6381
+ if ((user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & SITERIGHT_NOMESHCMD)) {
6382
+ // No tools allowed, close the websocket connection
6383
+ parent.debug('web', 'ERR: Websocket no tools allowed');
6384
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'notools', msg: 'notools' })); ws.close(); } catch (e) { }
6385
+ return;
6386
+ }
6387
+
6388
// Check if a 2nd factor is needed
6389
if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {
6390