Added version validation to serverupdate
Noah Zalev committed
May 29, 2021 at 14:17 UTC
2a0f0de8abacc61c2b43bdce18ad7caa0fe6f85b
2 files changed
+47
-3
meshcentral.js
+18
@@ -540,6 +540,24 @@ function CreateMeshCentralServer(config, args) {
540
} catch (ex) { callback({ current: getCurrentVersion() }, ex); } // If the system is running out of memory, an exception here can easily happen.
541
};
542
543
+ // Use NPM to get list of versions
544
+ obj.getServerVersions = function (callback) {
545
+ try {
546
+ var child_process = require('child_process');
547
+ var npmpath = ((typeof obj.args.npmpath == 'string') ? obj.args.npmpath : 'npm');
548
+ var npmproxy = ((typeof obj.args.npmproxy == 'string') ? (' --proxy ' + obj.args.npmproxy) : '');
549
+ var env = Object.assign({}, process.env); // Shallow clone
550
+ if (typeof obj.args.npmproxy == 'string') { env['HTTP_PROXY'] = env['HTTPS_PROXY'] = env['http_proxy'] = env['https_proxy'] = obj.args.npmproxy; }
551
+ var xxprocess = child_process.exec(npmpath + npmproxy + ' view meshcentral versions --json', { maxBuffer: 512000, cwd: obj.parentpath, env: env }, function (error, stdout, stderr) { });
552
+ xxprocess.data = '';
553
+ xxprocess.stdout.on('data', function (data) { xxprocess.data += data; });
554
+ xxprocess.stderr.on('data', function (data) { });
555
+ xxprocess.on('close', function (code) {
556
+ (code == 0) ? callback(xxprocess.data) : callback('{}');
557
+ });
558
+ } catch (ex) { callback('{}'); }
559
+ };
560
+
561
// Initiate server self-update
562
obj.performServerUpdate = function (version) {
563
if (obj.serverSelfWriteAllowed != true) return false;
meshuser.js
+29
-3
@@ -1192,11 +1192,37 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1192
1193
if (cmdargs['_'].length > 0) {
1194
version = cmdargs['_'][0];
1195
- }
1195
1197
- if (parent.parent.performServerUpdate(version) == false) {
1198
- r = 'Server self-update not possible.';
1196
+ // This call is SLOW. We only want to validate version if we have to
1197
+ if (version != 'stable' && version != 'latest') {
1198
+ parent.parent.getServerVersions((data) => {
1199
+ var versions = JSON.parse(data);
1200
+
1201
+ if (versions.includes(version)) {
1202
+ if (parent.parent.performServerUpdate(version) == false) {
1203
+ try {
1204
+ ws.send(JSON.stringify({ action: 'serverconsole',
1205
+ value: 'Server self-update not possible.'}));
1206
+ } catch (ex) { }
1207
+ }
1208
+ } else {
1209
+ try {
1210
+ ws.send(JSON.stringify({ action: 'serverconsole',
1211
+ value: 'Invalid version. Aborting update'}));
1212
+ } catch (ex) { }
1213
+ }
1214
+ });
1215
+ } else {
1216
+ if (parent.parent.performServerUpdate(version) == false) {
1217
+ r = 'Server self-update not possible.';
1218
+ }
1219
+ }
1220
+ } else {
1221
+ if (parent.parent.performServerUpdate(version) == false) {
1222
+ r = 'Server self-update not possible.';
1223
+ }
1224
}
1225
+
1226
break;
1227
}
1228
case 'print': {