Improved server tracing.
Ylian Saint-Hilaire committed
Aug 23, 2019 at 11:51 UTC
3aebee8f5e2fb95a810f9525adea6a1835e23671
3 files changed
+91
-28
meshcentral.js
+11
-10
@@ -45,7 +45,7 @@ function CreateMeshCentralServer(config, args) {
45
obj.connectivityByNode = {}; // This object keeps a list of all connected CIRA and agents, by nodeid->value (value: 1 = Agent, 2 = CIRA, 4 = AmtDirect)
46
obj.peerConnectivityByNode = {}; // This object keeps a list of all connected CIRA and agents of peers, by serverid->nodeid->value (value: 1 = Agent, 2 = CIRA, 4 = AmtDirect)
47
obj.debugSources = [];
48
- obj.debugRemoteSources = [];
48
+ obj.debugRemoteSources = null;
49
obj.config = config; // Configuration file
50
obj.dbconfig = {}; // Persistance values, loaded from database
51
obj.certificateOperations = null;
@@ -109,7 +109,7 @@ function CreateMeshCentralServer(config, args) {
109
try { require('./pass').hash('test', function () { }, 0); } catch (e) { console.log('Old version of node, must upgrade.'); return; } // TODO: Not sure if this test works or not.
110
111
// Check for invalid arguments
112
- var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'remotedebug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbexportmin', 'dbimport', 'dbmerge', 'dbencryptkey', 'selfupdate', 'tlsoffload', 'userallowedip', 'userblockedip', 'swarmallowedip', 'agentallowedip', 'agentblockedip', 'fastcert', 'swarmport', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin', 'sessionkey', 'sessiontime', 'minify', 'minifycore', 'dblistconfigfiles', 'dbshowconfigfile', 'dbpushconfigfiles', 'dbpullconfigfiles', 'dbdeleteconfigfiles', 'configkey', 'loadconfigfromdb', 'npmpath', 'memorytracking', 'serverid'];
112
+ var validArguments = ['_', 'notls', 'user', 'port', 'aliasport', 'mpsport', 'mpsaliasport', 'redirport', 'cert', 'mpscert', 'deletedomain', 'deletedefaultdomain', 'showall', 'showusers', 'shownodes', 'showmeshes', 'showevents', 'showpower', 'clearpower', 'showiplocations', 'help', 'exactports', 'install', 'uninstall', 'start', 'stop', 'restart', 'debug', 'filespath', 'datapath', 'noagentupdate', 'launch', 'noserverbackup', 'mongodb', 'mongodbcol', 'wanonly', 'lanonly', 'nousers', 'mpspass', 'ciralocalfqdn', 'dbexport', 'dbexportmin', 'dbimport', 'dbmerge', 'dbencryptkey', 'selfupdate', 'tlsoffload', 'userallowedip', 'userblockedip', 'swarmallowedip', 'agentallowedip', 'agentblockedip', 'fastcert', 'swarmport', 'logintoken', 'logintokenkey', 'logintokengen', 'logintokengen', 'mailtokengen', 'admin', 'unadmin', 'sessionkey', 'sessiontime', 'minify', 'minifycore', 'dblistconfigfiles', 'dbshowconfigfile', 'dbpushconfigfiles', 'dbpullconfigfiles', 'dbdeleteconfigfiles', 'configkey', 'loadconfigfromdb', 'npmpath', 'memorytracking', 'serverid'];
113
for (var arg in obj.args) { obj.args[arg.toLocaleLowerCase()] = obj.args[arg]; if (validArguments.indexOf(arg.toLocaleLowerCase()) == -1) { console.log('Invalid argument "' + arg + '", use --help.'); return; } }
114
if (obj.args.mongodb == true) { console.log('Must specify: --mongodb [connectionstring] \r\nSee https://docs.mongodb.com/manual/reference/connection-string/ for MongoDB connection string.'); return; }
115
for (i in obj.config.settings) { obj.args[i] = obj.config.settings[i]; } // Place all settings into arguments, arguments have already been placed into settings so arguments take precedence.
@@ -264,11 +264,6 @@ function CreateMeshCentralServer(config, args) {
264
else if (typeof obj.args.debug == 'object') { obj.debugSources = obj.args.debug; }
265
else if (obj.args.debug === true) { obj.debugSources = '*'; }
266
267
- // Remote web application tracing
268
- if (typeof obj.args.remotedebug == 'string') { obj.debugRemoteSources = obj.args.remotedebug.toLowerCase().split(','); }
269
- else if (typeof obj.args.remotedebug == 'object') { obj.debugRemoteSources = obj.args.remotedebug; }
270
- else if (obj.args.remotedebug === true) { obj.debugRemoteSources = '*'; }
271
-
267
require('./db.js').CreateDB(obj,
268
function (db) {
269
obj.db = db;
@@ -1574,8 +1569,10 @@ function CreateMeshCentralServer(config, args) {
1569
o.time = Math.floor(Date.now() / 1000); // Add the cookie creation time
1570
const iv = Buffer.from(obj.crypto.randomBytes(12), 'binary'), cipher = obj.crypto.createCipheriv('aes-256-gcm', key.slice(0, 32), iv);
1571
const crypted = Buffer.concat([cipher.update(JSON.stringify(o), 'utf8'), cipher.final()]);
1577
- return Buffer.concat([iv, cipher.getAuthTag(), crypted]).toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
1578
- } catch (e) { return null; }
1572
+ var r = Buffer.concat([iv, cipher.getAuthTag(), crypted]).toString('base64').replace(/\+/g, '@').replace(/\//g, '$');
1573
+ obj.debug('cookie', 'Encoded AESGCM cookie: ' + JSON.stringify(o));
1574
+ return r;
1575
+ } catch (ex) { obj.debug('cookie', 'ERR: Failed to encode AESGCM cookie due to exception: ' + ex); return null; }
1576
};
1577
1578
// Decode a cookie back into an object using a key using AES256-GCM or AES128-CBC/HMAC-SHA386. Return null if it's not a valid cookie. (key must be 32 bytes or more)
@@ -1604,6 +1601,7 @@ function CreateMeshCentralServer(config, args) {
1601
// An expire time is included in the cookie (in minutes), use this.
1602
if ((o.expire !== 0) && ((o.dtime > (o.expire * 60000)) || (o.dtime < -30000))) { obj.debug('cookie', 'ERR: Bad cookie due to timeout'); return null; } // The cookie is only valid 120 seconds, or 30 seconds back in time (in case other server's clock is not quite right)
1603
}
1604
+ obj.debug('cookie', 'Decoded AESGCM cookie: ' + JSON.stringify(o));
1605
return o;
1606
} catch (ex) { obj.debug('cookie', 'ERR: Bad AESGCM cookie due to exception: ' + ex); return null; }
1607
};
@@ -1632,6 +1630,7 @@ function CreateMeshCentralServer(config, args) {
1630
// An expire time is included in the cookie (in minutes), use this.
1631
if ((o.expire !== 0) && ((o.dtime > (o.expire * 60000)) || (o.dtime < -30000))) { obj.debug('cookie', 'ERR: Bad cookie due to timeout'); return null; } // The cookie is only valid 120 seconds, or 30 seconds back in time (in case other server's clock is not quite right)
1632
}
1633
+ obj.debug('cookie', 'Decoded AESSHA cookie: ' + JSON.stringify(o));
1634
return o;
1635
} catch (ex) { obj.debug('cookie', 'ERR: Bad AESSHA cookie due to exception: ' + ex); return null; }
1636
};
@@ -1643,15 +1642,17 @@ function CreateMeshCentralServer(config, args) {
1642
1643
// Send the event to logged in administrators
1644
if ((obj.debugRemoteSources != null) && ((obj.debugRemoteSources == '*') || (obj.debugRemoteSources.indexOf(source) >= 0))) {
1645
+ var sendcount = 0;
1646
for (var sessionid in obj.webserver.wssessions2) {
1647
var ws = obj.webserver.wssessions2[sessionid];
1648
if ((ws != null) && (ws.userid != null)) {
1649
var user = obj.webserver.users[ws.userid];
1650
if ((user != null) && (user.siteadmin == 4294967295)) {
1651
- try { ws.send(JSON.stringify({ action: 'trace', source: source, args: args, time: Date.now() })); } catch (ex) { }
1651
+ try { ws.send(JSON.stringify({ action: 'trace', source: source, args: args, time: Date.now() })); sendcount++; } catch (ex) { }
1652
}
1653
}
1654
}
1655
+ if (sendcount == 0) { obj.debugRemoteSources = null; } // If there are no listeners, remove debug sources.
1656
}
1657
};
1658
views/default.handlebars
+12
-8
@@ -1391,10 +1391,11 @@
1391
}
1392
case 'traceinfo': {
1393
if (typeof message.traceSources == 'object') {
1394
- serverTraceSources = message.traceSources;
1395
- if (message.traceSources.length > 0) {
1394
+ if ((message.traceSources != null) && (message.traceSources.length > 0)) {
1395
+ serverTraceSources = message.traceSources;
1396
QH('p41traceStatus', EscapeHtml(message.traceSources.join(', ')));
1397
} else {
1398
+ serverTraceSources = [];
1399
QH('p41traceStatus', 'None');
1400
}
1401
}
@@ -2119,10 +2120,11 @@
2120
}
2121
case 'traceinfo': {
2122
if (typeof message.event.traceSources == 'object') {
2122
- serverTraceSources = message.event.traceSources;
2123
- if (message.event.traceSources.length > 0) {
2123
+ if ((message.event.traceSources != null) && (message.event.traceSources.length > 0)) {
2124
+ serverTraceSources = message.event.traceSources;
2125
QH('p41traceStatus', EscapeHtml(message.event.traceSources.join(', ')));
2126
} else {
2127
+ serverTraceSources = [];
2128
QH('p41traceStatus', 'None');
2129
}
2130
}
@@ -4878,7 +4880,7 @@
4880
case 2:
4881
break;
4882
case 3:
4881
- if (desktop.serverIsRecording == true) { QV('deskRecordIcon', true); }
4883
+ if (desktop && (desktop.serverIsRecording == true)) { QV('deskRecordIcon', true); }
4884
break;
4885
default:
4886
//console.log('Unknown onDesktopStateChange state', state);
@@ -5444,7 +5446,7 @@
5446
break;
5447
case 3:
5448
QE('termSizeList', false);
5447
- if (xterminal.serverIsRecording == true) { QV('termRecordIcon', true); }
5449
+ if (xterminal && (xterminal.serverIsRecording == true)) { QV('termRecordIcon', true); }
5450
break;
5451
default:
5452
QE('termSizeList', false);
@@ -5596,8 +5598,10 @@
5598
break;
5599
case 3:
5600
p13targetpath = '';
5599
- files.sendText({ action: 'ls', reqid: 1, path: '' });
5600
- if (files.serverIsRecording == true) { QV('filesRecordIcon', true); }
5601
+ if (files) {
5602
+ files.sendText({ action: 'ls', reqid: 1, path: '' });
5603
+ if (files.serverIsRecording == true) { QV('filesRecordIcon', true); }
5604
+ }
5605
break;
5606
default:
5607
//console.log('Unknown onFilesStateChange state', state);
webserver.js
+68
-10
@@ -489,7 +489,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
489
490
function handleLogoutRequest(req, res) {
491
const domain = checkUserIpAddress(req, res);
492
- if ((domain == null) || (domain.auth == 'sspi')) { res.sendStatus(404); return; }
492
+ if ((domain == null) || (domain.auth == 'sspi')) {
493
+ parent.debug('web', 'handleLogoutRequest: failed checks.');
494
+ res.sendStatus(404);
495
+ return;
496
+ }
497
498
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
499
// Destroy the user's session to log them out will be re-created next request
@@ -499,6 +503,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
503
}
504
req.session = null;
505
res.redirect(domain.url);
506
+ parent.debug('web', 'handleLogoutRequest: success.');
507
}
508
509
// Return true if this user has 2-step auth active
@@ -619,7 +624,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
624
625
function handleLoginRequest(req, res) {
626
const domain = checkUserIpAddress(req, res);
622
- if (domain == null) { res.sendStatus(404); return; }
627
+ if (domain == null) { parent.debug('web', 'handleLoginRequest: invalid domain'); res.sendStatus(404); return; }
628
629
// Normally, use the body username/password. If this is a token, use the username/password in the session.
630
var xusername = req.body.username, xpassword = req.body.password;
@@ -640,6 +645,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
645
if ((req.body.token != null) || (req.body.hwtoken != null)) {
646
randomWaitTime = 2000 + (obj.crypto.randomBytes(2).readUInt16BE(0) % 4095); // This is a fail, wait a random time. 2 to 6 seconds.
647
req.session.error = '<b style=color:#8C001A>Invalid token, try again.</b>';
648
+ parent.debug('web', 'handleLoginRequest: invalid 2FA token');
649
+ } else {
650
+ parent.debug('web', 'handleLoginRequest: 2FA token required');
651
}
652
653
// Wait and redirect the user
@@ -651,6 +659,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
659
}, randomWaitTime);
660
} else {
661
// Login succesful
662
+ parent.debug('web', 'handleLoginRequest: succesful 2FA login');
663
completeLoginRequest(req, res, domain, user, userid, xusername, xpassword);
664
}
665
});
@@ -658,12 +667,19 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
667
}
668
669
// Login succesful
670
+ parent.debug('web', 'handleLoginRequest: succesful login');
671
completeLoginRequest(req, res, domain, user, userid, xusername, xpassword);
672
} else {
673
// Login failed, wait a random delay
674
setTimeout(function () {
675
// If the account is locked, display that.
666
- if (err == 'locked') { req.session.error = '<b style=color:#8C001A>Account locked.</b>'; } else { req.session.error = '<b style=color:#8C001A>Login failed, check username and password.</b>'; }
676
+ if (err == 'locked') {
677
+ parent.debug('web', 'handleLoginRequest: login failed, locked account');
678
+ req.session.error = '<b style=color:#8C001A>Account locked.</b>';
679
+ } else {
680
+ parent.debug('web', 'handleLoginRequest: login failed, bad username and password');
681
+ req.session.error = '<b style=color:#8C001A>Login failed, check username and password.</b>';
682
+ }
683
684
// Clean up login mode and display password hint if present.
685
delete req.session.loginmode;
@@ -682,6 +698,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
698
// Check if we need to change the password
699
if ((typeof user.passchange == 'number') && ((user.passchange == -1) || ((typeof domain.passwordrequirements == 'object') && (typeof domain.passwordrequirements.reset == 'number') && (user.passchange + (domain.passwordrequirements.reset * 86400) < Math.floor(Date.now() / 1000))))) {
700
// Request a password change
701
+ parent.debug('web', 'handleLoginRequest: login ok, password change requested');
702
req.session.loginmode = '6';
703
req.session.error = '<b style=color:#8C001A>Password change requested.</b>';
704
req.session.resettokenusername = xusername;
@@ -729,8 +746,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
746
res.redirect(domain.url + getQueryPortion(req));
747
});
748
*/
749
+ parent.debug('web', 'handleLoginRequest: login ok (1)');
750
res.redirect(domain.url + getQueryPortion(req)); // Temporary
751
} else {
752
+ parent.debug('web', 'handleLoginRequest: login ok (2)');
753
res.redirect(domain.url + getQueryPortion(req));
754
}
755
//});
@@ -759,6 +778,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
778
var i = -1;
779
if (typeof req.body.email == 'string') { i = req.body.email.indexOf('@'); }
780
if (i == -1) {
781
+ parent.debug('web', 'handleCreateAccountRequest: unable to create account (1)');
782
req.session.loginmode = '2';
783
req.session.error = '<b style=color:#8C001A>Unable to create account.</b>';
784
res.redirect(domain.url + getQueryPortion(req));
@@ -767,6 +787,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
787
var emailok = false, emaildomain = req.body.email.substring(i + 1).toLowerCase();
788
for (var i in domain.newaccountemaildomains) { if (emaildomain == domain.newaccountemaildomains[i].toLowerCase()) { emailok = true; } }
789
if (emailok == false) {
790
+ parent.debug('web', 'handleCreateAccountRequest: unable to create account (2)');
791
req.session.loginmode = '2';
792
req.session.error = '<b style=color:#8C001A>Unable to create account.</b>';
793
res.redirect(domain.url + getQueryPortion(req));
@@ -777,12 +798,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
798
// Check if we exceed the maximum number of user accounts
799
obj.db.isMaxType(domain.limits.maxuseraccounts, 'user', domain.id, function (maxExceed) {
800
if (maxExceed) {
801
+ parent.debug('web', 'handleCreateAccountRequest: account limit reached');
802
req.session.loginmode = '2';
803
req.session.error = '<b style=color:#8C001A>Account limit reached.</b>';
804
console.log('max', req.session);
805
res.redirect(domain.url + getQueryPortion(req));
806
} else {
807
if (!obj.common.validateUsername(req.body.username, 1, 64) || !obj.common.validateEmail(req.body.email, 1, 256) || !obj.common.validateString(req.body.password1, 1, 256) || !obj.common.validateString(req.body.password2, 1, 256) || (req.body.password1 != req.body.password2) || req.body.username == '~' || !obj.common.checkPasswordRequirements(req.body.password1, domain.passwordrequirements)) {
808
+ parent.debug('web', 'handleCreateAccountRequest: unable to create account (3)');
809
req.session.loginmode = '2';
810
req.session.error = '<b style=color:#8C001A>Unable to create account.</b>';
811
res.redirect(domain.url + getQueryPortion(req));
@@ -790,12 +813,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
813
// Check if this email was already verified
814
obj.db.GetUserWithVerifiedEmail(domain.id, req.body.email, function (err, docs) {
815
if (docs.length > 0) {
816
+ parent.debug('web', 'handleCreateAccountRequest: Existing account with this email address');
817
req.session.loginmode = '2';
818
req.session.error = '<b style=color:#8C001A>Existing account with this email address.</b>';
819
res.redirect(domain.url + getQueryPortion(req));
820
} else {
821
// Check if there is domain.newAccountToken, check if supplied token is valid
822
if ((domain.newaccountspass != null) && (domain.newaccountspass != '') && (req.body.anewaccountpass != domain.newaccountspass)) {
823
+ parent.debug('web', 'handleCreateAccountRequest: Invalid account creation token');
824
req.session.loginmode = '2';
825
req.session.error = '<b style=color:#8C001A>Invalid account creation token.</b>';
826
res.redirect(domain.url + getQueryPortion(req));
@@ -803,6 +828,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
828
}
829
// Check if user exists
830
if (obj.users['user/' + domain.id + '/' + req.body.username.toLowerCase()]) {
831
+ parent.debug('web', 'handleCreateAccountRequest: Username already exists');
832
req.session.loginmode = '2';
833
req.session.error = '<b style=color:#8C001A>Username already exists.</b>';
834
} else {
@@ -842,6 +868,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
868
869
// Check everything is ok
870
if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (typeof req.body.rpassword1 != 'string') || (typeof req.body.rpassword2 != 'string') || (req.body.rpassword1 != req.body.rpassword2) || (typeof req.body.rpasswordhint != 'string') || (req.session == null) || (typeof req.session.resettokenusername != 'string') || (typeof req.session.resettokenpassword != 'string')) {
871
+ parent.debug('web', 'handleResetPasswordRequest: checks failed');
872
delete req.session.loginmode;
873
delete req.session.tokenusername;
874
delete req.session.tokenpassword;
@@ -863,6 +890,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
890
891
// If we have password requirements, check this here.
892
if (!obj.common.checkPasswordRequirements(req.body.rpassword1, domain.passwordrequirements)) {
893
+ parent.debug('web', 'handleResetPasswordRequest: password rejected, use a different one (1)');
894
req.session.loginmode = '6';
895
req.session.error = '<b style=color:#8C001A>Password rejected, use a different one.</b>';
896
res.redirect(domain.url + getQueryPortion(req));
@@ -873,6 +901,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
901
require('./pass').hash(req.body.rpassword1, user.salt, function (err, hash, tag) {
902
if (user.hash == hash) {
903
// This is the same password, request a password change again
904
+ parent.debug('web', 'handleResetPasswordRequest: password rejected, use a different one (2)');
905
req.session.loginmode = '6';
906
req.session.error = '<b style=color:#8C001A>Password rejected, use a different one.</b>';
907
res.redirect(domain.url + getQueryPortion(req));
@@ -891,6 +920,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
920
obj.parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
921
922
// Login succesful
923
+ parent.debug('web', 'handleResetPasswordRequest: success');
924
req.session.userid = userid;
925
req.session.domainid = domain.id;
926
completeLoginRequest(req, res, domain, obj.users[userid], userid, req.session.tokenusername, req.session.tokenpassword);
@@ -899,6 +929,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
929
}, 0);
930
} else {
931
// Failed, error out.
932
+ parent.debug('web', 'handleResetPasswordRequest: failed authenticate()');
933
delete req.session.loginmode;
934
delete req.session.tokenusername;
935
delete req.session.tokenpassword;
@@ -917,7 +948,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
948
// Called to process an account reset request
949
function handleResetAccountRequest(req, res) {
950
const domain = checkUserIpAddress(req, res);
920
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (obj.args.lanonly == true) || (obj.parent.certificates.CommonName == null) || (obj.parent.certificates.CommonName.indexOf('.') == -1)) { res.sendStatus(404); return; }
951
+ if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (obj.args.lanonly == true) || (obj.parent.certificates.CommonName == null) || (obj.parent.certificates.CommonName.indexOf('.') == -1)) {
952
+ parent.debug('web', 'handleResetAccountRequest: check failed');
953
+ res.sendStatus(404);
954
+ return;
955
+ }
956
957
// Always lowercase the email address
958
if (req.body.email) { req.body.email = req.body.email.toLowerCase(); }
@@ -928,12 +963,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
963
964
// Check the email string format
965
if (!email || checkEmail(email) == false) {
966
+ parent.debug('web', 'handleResetAccountRequest: Invalid email');
967
req.session.loginmode = '3';
968
req.session.error = '<b style=color:#8C001A>Invalid email.</b>';
969
res.redirect(domain.url + getQueryPortion(req));
970
} else {
971
obj.db.GetUserWithVerifiedEmail(domain.id, email, function (err, docs) {
972
if ((err != null) || (docs.length == 0)) {
973
+ parent.debug('web', 'handleResetAccountRequest: Account not found');
974
req.session.loginmode = '3';
975
req.session.error = '<b style=color:#8C001A>Account not found.</b>';
976
res.redirect(domain.url + getQueryPortion(req));
@@ -948,6 +985,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
985
if (result == false) {
986
if (i == 0) {
987
// 2-step auth is required, but the token is not present or not valid.
988
+ parent.debug('web', 'handleResetAccountRequest: Invalid 2FA token, try again');
989
if ((req.body.token != null) || (req.body.hwtoken != null)) { req.session.error = '<b style=color:#8C001A>Invalid token, try again.</b>'; }
990
req.session.loginmode = '5';
991
req.session.tokenemail = email;
@@ -959,12 +997,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
997
if (obj.parent.mailserver != null) {
998
obj.parent.mailserver.sendAccountResetMail(domain, user.name, user.email);
999
if (i == 0) {
1000
+ parent.debug('web', 'handleResetAccountRequest: Hold on, reset mail sent.');
1001
req.session.loginmode = '1';
1002
req.session.error = '<b style=color:darkgreen>Hold on, reset mail sent.</b>';
1003
res.redirect(domain.url + getQueryPortion(req));
1004
}
1005
} else {
1006
if (i == 0) {
1007
+ parent.debug('web', 'handleResetAccountRequest: Unable to sent email.');
1008
req.session.loginmode = '3';
1009
req.session.error = '<b style=color:#8C001A>Unable to sent email.</b>';
1010
res.redirect(domain.url + getQueryPortion(req));
@@ -977,12 +1017,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1017
if (obj.parent.mailserver != null) {
1018
obj.parent.mailserver.sendAccountResetMail(domain, user.name, user.email);
1019
if (i == 0) {
1020
+ parent.debug('web', 'handleResetAccountRequest: Hold on, reset mail sent.');
1021
req.session.loginmode = '1';
1022
req.session.error = '<b style=color:darkgreen>Hold on, reset mail sent.</b>';
1023
res.redirect(domain.url + getQueryPortion(req));
1024
}
1025
} else {
1026
if (i == 0) {
1027
+ parent.debug('web', 'handleResetAccountRequest: Unable to sent email.');
1028
req.session.loginmode = '3';
1029
req.session.error = '<b style=color:#8C001A>Unable to sent email.</b>';
1030
res.redirect(domain.url + getQueryPortion(req));
@@ -998,7 +1040,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1040
// Called to process a web based email verification request
1041
function handleCheckMailRequest(req, res) {
1042
const domain = checkUserIpAddress(req, res);
1001
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { res.sendStatus(404); return; }
1043
+ if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) {
1044
+ parent.debug('web', 'handleCheckMailRequest: failed checks.');
1045
+ res.sendStatus(404);
1046
+ return;
1047
+ }
1048
1049
if (req.query.c != null) {
1050
var cookie = obj.parent.decodeCookie(req.query.c, obj.parent.mailserver.mailCookieEncryptionKey, 30);
@@ -1090,7 +1136,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1136
// Called to process an agent invite request
1137
function handleAgentInviteRequest(req, res) {
1138
const domain = checkUserIpAddress(req, res);
1093
- if ((domain == null) || ((req.query.m == null) && (req.query.c == null))) { res.sendStatus(404); return; }
1139
+ if ((domain == null) || ((req.query.m == null) && (req.query.c == null))) {
1140
+ parent.debug('web', 'handleAgentInviteRequest: failed checks.');
1141
+ res.sendStatus(404);
1142
+ return;
1143
+ }
1144
if (req.query.c != null) {
1145
// A cookie is specified in the query string, use that
1146
var cookie = obj.parent.decodeCookie(req.query.c, obj.parent.invitationLinkEncryptionKey);
@@ -1113,7 +1163,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1163
1164
function handleDeleteAccountRequest(req, res) {
1165
const domain = checkUserIpAddress(req, res);
1116
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { res.sendStatus(404); return; }
1166
+ if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) {
1167
+ parent.debug('web', 'handleDeleteAccountRequest: failed checks.');
1168
+ res.sendStatus(404);
1169
+ return;
1170
+ }
1171
1172
// Check if the user is logged and we have all required parameters
1173
if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url + getQueryPortion(req)); return; }
@@ -1183,7 +1237,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1237
// Handle password changes
1238
function handlePasswordChangeRequest(req, res) {
1239
const domain = checkUserIpAddress(req, res);
1186
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { res.sendStatus(404); return; }
1240
+ if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) {
1241
+ parent.debug('web', 'handlePasswordChangeRequest: failed checks.');
1242
+ res.sendStatus(404);
1243
+ return;
1244
+ }
1245
1246
// Check if the user is logged and we have all required parameters
1247
if (!req.session || !req.session.userid || !req.body.apassword0 || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url + getQueryPortion(req)); return; }
@@ -1215,8 +1273,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1273
// Indicates that any request to "/" should render "default" or "login" depending on login state
1274
function handleRootRequest(req, res) {
1275
const domain = checkUserIpAddress(req, res);
1218
- if (domain == null) { res.sendStatus(404); return; }
1219
- if (!obj.args) { res.sendStatus(500); return; }
1276
+ if (domain == null) { parent.debug('web', 'handleRootRequest: invalid domain.'); res.sendStatus(404); return; }
1277
+ if (!obj.args) { parent.debug('web', 'handleRootRequest: no obj.args.'); res.sendStatus(500); return; }
1278
1279
if ((domain.sspi != null) && ((req.query.login == null) || (obj.parent.loginCookieEncryptionKey == null))) {
1280
// Login using SSPI