Added option to allow framing.
Ylian Saint-Hilaire committed
Dec 19, 2017 at 08:50 UTC
400f853732bcdcf25d68858aa05c47b9f08914e7
9 files changed
+42
-22
agents/MeshService.exe
Binary files a/agents/MeshService.exe and b/agents/MeshService.exe differ
agents/MeshService64.exe
Binary files a/agents/MeshService64.exe and b/agents/MeshService64.exe differ
agents/meshcore.js
+18
-12
@@ -64,16 +64,16 @@ function createMeshCore(agent) {
64
// If we are running in Duktape, agent will be null
65
if (agent == null) {
66
// Running in native agent, Import libraries
67
- var db = require('SimpleDataStore').Shared();
68
- var sha = require('SHA256Stream');
69
- var mesh = require('MeshAgent');
70
- var processManager = require('ILibProcessPipe');
67
+ db = require('SimpleDataStore').Shared();
68
+ sha = require('SHA256Stream');
69
+ mesh = require('MeshAgent');
70
+ processManager = require('ILibProcessPipe');
71
if (mesh.hasKVM == 1) { obj.meshCoreCapabilities |= 1; }
72
} else {
73
// Running in nodejs
74
obj.meshCoreInfo += '-NodeJS';
75
obj.meshCoreCapabilities = 8;
76
- var mesh = agent.getMeshApi();
76
+ mesh = agent.getMeshApi();
77
}
78
79
// Get our location (lat/long) using our public IP address
@@ -464,7 +464,9 @@ function createMeshCore(agent) {
464
}
465
function onTunnelSendOk() { sendConsoleText("Tunnel #" + this.index + " SendOK.", this.sessionid); }
466
function onTunnelData(data) {
467
- console.log("OnTunnelData");
467
+ //console.log("OnTunnelData");
468
+ //sendConsoleText('OnTunnelData, ' + data.length + ', ' + typeof data + ', ' + data);
469
+
470
// If this is upload data, save it to file
471
if (this.httprequest.uploadFile) {
472
try { fs.writeSync(this.httprequest.uploadFile, data); } catch (e) { this.write(JSON.stringify({ action: 'uploaderror' })); return; } // Write to the file, if there is a problem, error out.
@@ -530,8 +532,8 @@ function createMeshCore(agent) {
532
}
533
this.httprequest.process.tunnel = this;
534
this.httprequest.process.error.data = function (chunk) { this.parent.tunnel.write(chunk); }
533
- this.httprequest.process.pipe(this);
534
- this.pipe(this.httprequest.process);
535
+ this.httprequest.process.pipe(this, { dataTypeSkip: 1 }); // 0 = Binary, 1 = Text.
536
+ this.pipe(this.httprequest.process, { dataTypeSkip: 1 }); // 0 = Binary, 1 = Text.
537
}
538
}
539
if (this.httprequest.protocol == 2) {
@@ -555,8 +557,11 @@ function createMeshCore(agent) {
557
if (this.desktop.kvm.connectionCount == 0) { this.httprequest.desktop.kvm.end(); }
558
};
559
if (this.httprequest.desktop.kvm.hasOwnProperty("connectionCount")) { this.httprequest.desktop.kvm.connectionCount++; } else { this.httprequest.desktop.kvm.connectionCount = 1; }
558
- this.pipe(this.httprequest.desktop.kvm);
559
- this.httprequest.desktop.kvm.pipe(this);
560
+ //this.write('Hello!');
561
+ //sendConsoleText('KVM WriteHello');
562
+ this.pipe(this.httprequest.desktop.kvm, { dataTypeSkip: 1 }); // 0 = Binary, 1 = Text.
563
+ this.httprequest.desktop.kvm.pipe(this, { dataTypeSkip: 1 }); // 0 = Binary, 1 = Text.
564
+ //this.on('data', function (data) { sendConsoleText('KVM: ' + data); });
565
}
566
}
567
else if (this.httprequest.protocol == 5) {
@@ -704,6 +709,7 @@ function createMeshCore(agent) {
709
response += '\r\nModules: ' + JSON.stringify(addedModules) + '';
710
var oldNodeId = db.Get('OldNodeId');
711
if (oldNodeId != null) { response += '\r\nOldNodeID: ' + oldNodeId + '.'; }
712
+ response += '\r\ServerState: ' + meshServerConnectionState + '.';
713
break;
714
}
715
case 'selfinfo': { // Return self information block
@@ -1002,7 +1008,7 @@ function createMeshCore(agent) {
1008
1009
// Called periodically to check if we need to send updates to the server
1010
function sendPeriodicServerUpdate(force) {
1005
- if (amtMeiConnected != 1) { // If we are pending MEI connection, hold off on updating the server on self-info
1011
+ if ((amtMeiConnected != 1) || (force == true)) { // If we are pending MEI connection, hold off on updating the server on self-info
1012
// Update the self information data
1013
var selfInfo = buildSelfInfo(), selfInfoStr = JSON.stringify(selfInfo);
1014
if ((force == true) || (selfInfoStr != lastSelfInfo)) { mesh.SendCommand(selfInfo); lastSelfInfo = selfInfoStr; }
@@ -1071,7 +1077,7 @@ function createMeshCore(agent) {
1077
mesh.AddCommandHandler(handleServerCommand);
1078
mesh.AddConnectHandler(handleServerConnection);
1079
//mesh.lmsNotification = handleAmtNotification; // TODO
1074
- sendPeriodicServerUpdate(); // TODO: Check if connected before sending
1080
+ sendPeriodicServerUpdate(true); // TODO: Check if connected before sending
1081
1082
// Parse input arguments
1083
//var args = parseArgs(process.argv);
meshrelay.js
+1
-1
@@ -180,7 +180,7 @@ module.exports.CreateMeshRelay = function (parent, ws, req, domain) {
180
181
// When data is received from the mesh relay web socket
182
ws.on('message', function (data) {
183
- //console.log(typeof data);
183
+ //console.log(typeof data, data.length);
184
//if (typeof data == 'string') console.log(data);
185
if (this.peer != null) { try { this.pause(); this.peer.send(data, ws.flushSink); } catch (e) { } }
186
});
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.1.1-f",
3
+ "version": "0.1.1-h",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
public/scripts/agent-redir-ws-0.1.0.js
+3
-2
@@ -47,6 +47,8 @@ var CreateAgentRedirect = function (meshserver, module, serverPublicNamePort) {
47
48
// Called to pass websocket control messages
49
obj.xxOnControlCommand = function (msg) {
50
+ //console.log(msg);
51
+ //obj.socket.send('hellobob');
52
var controlMsg = JSON.parse(msg);
53
if ((controlMsg.type == 'answer') && (obj.webrtc != null)) {
54
console.log('gotAnswer', JSON.stringify(controlMsg));
@@ -106,8 +108,7 @@ var CreateAgentRedirect = function (meshserver, module, serverPublicNamePort) {
108
if (typeof e.data == 'string') {
109
// Control messages, most likely WebRTC setup
110
obj.xxOnControlCommand(e.data);
109
- }
110
- if (typeof e.data == 'object') {
111
+ } else if (typeof e.data == 'object') {
112
var f = new FileReader();
113
if (f.readAsBinaryString) {
114
// Chrome & Firefox (Draft)
views/default.handlebars
+7
-5
@@ -636,10 +636,12 @@
636
var clickOnce = detectClickOnce();
637
638
function startup() {
639
- // Guard against other site's top frames (web bugs).
640
- var loc = null;
641
- try { loc = top.location.toString().toLowerCase(); } catch (e) { }
642
- if (top != self && (loc == null || top.active == false)) { top.location = self.location; return; }
639
+ if ((features & 32) == 0) {
640
+ // Guard against other site's top frames (web bugs).
641
+ var loc = null;
642
+ try { loc = top.location.toString().toLowerCase(); } catch (e) { }
643
+ if (top != self && (loc == null || top.active == false)) { top.location = self.location; return; }
644
+ }
645
646
// Check if we are in debug mode
647
args = parseUriArgs();
@@ -754,7 +756,7 @@
756
hideContextMenu(); // Hide the context menu if present
757
QV('verifyEmailId2', false);
758
QV('logoutControl', false);
757
- serverPoll();
759
+ setTimeout(serverPoll, 5000);
760
} else if (state == 2) {
761
// Fetch list of meshes, nodes, files
762
meshserver.Send({ action: 'meshes' });
views/login.handlebars
+8
@@ -169,8 +169,16 @@
169
var passhint = "{{{passhint}}}";
170
var newAccountPass = {{{newAccountPass}}};
171
var emailCheck = {{{emailcheck}}};
172
+ var features = {{{features}}};
173
174
function startup() {
175
+ if ((features & 32) == 0) {
176
+ // Guard against other site's top frames (web bugs).
177
+ var loc = null;
178
+ try { loc = top.location.toString().toLowerCase(); } catch (e) { }
179
+ if (top != self && (loc == null || top.active == false)) { top.location = self.location; return; }
180
+ }
181
+
182
window.onresize = center;
183
center();
184
validateLogin();
webserver.js
+4
-1
@@ -613,13 +613,16 @@ module.exports.CreateWebServer = function (parent, db, args, secret, certificate
613
if (obj.args.nousers == true) { features += 4; } // Single user mode
614
if (domain.userQuota == -1) { features += 8; } // No server files mode
615
if (obj.args.tlsoffload == true) { features += 16; } // No mutual-auth CIRA
616
+ if (parent.config.settings.allowFraming == true) { features += 32; } // Allow site within iframe
617
if ((!obj.args.user) && (obj.args.nousers != true)) { logoutcontrol += ' <a href=' + domain.url + 'logout?' + Math.random() + ' style=color:white>Logout</a>'; } // If a default user is in use or no user mode, don't display the logout button
618
res.render(obj.path.join(__dirname, 'views/default'), { viewmode: viewmode, currentNode: currentNode, logoutControl: logoutcontrol, title: domain.title, title2: domain.title2, domainurl: domain.url, domain: domain.id, debuglevel: parent.debugLevel, serverDnsName: obj.certificates.CommonName, serverRedirPort: args.redirport, serverPublicPort: args.port, noServerBackup: (args.noserverbackup == 1 ? 1 : 0), features: features, mpspass: args.mpspass, webcerthash: obj.webCertificateHashBase64 });
619
} else {
620
// Send back the login application
621
var loginmode = req.session.loginmode;
622
delete req.session.loginmode; // Clear this state, if the user hits refresh, we want to go back to the login page.
622
- res.render(obj.path.join(__dirname, 'views/login'), { loginmode: loginmode, rootCertLink: getRootCertLink(), title: domain.title, title2: domain.title2, newAccount: domain.newaccounts, newAccountPass: (((domain.newaccountspass == null) || (domain.newaccountspass == '')) ? 0 : 1), serverDnsName: obj.certificates.CommonName, serverPublicPort: obj.args.port, emailcheck: obj.parent.mailserver != null });
623
+ var features = 0;
624
+ if (parent.config.settings.allowFraming == true) { features += 32; } // Allow site within iframe
625
+ res.render(obj.path.join(__dirname, 'views/login'), { loginmode: loginmode, rootCertLink: getRootCertLink(), title: domain.title, title2: domain.title2, newAccount: domain.newaccounts, newAccountPass: (((domain.newaccountspass == null) || (domain.newaccountspass == '')) ? 0 : 1), serverDnsName: obj.certificates.CommonName, serverPublicPort: obj.args.port, emailcheck: obj.parent.mailserver != null, features: features });
626
}
627
}
628