More work on login tokens.
Ylian Saint-Hilaire committed
Apr 16, 2021 at 11:16 UTC
4231f4071b5eddaed36bdab2b4491a172e2fda5e
2 files changed
+25
-1
views/default.handlebars
-1
@@ -10444,7 +10444,6 @@
10444
QV('p2noMeshFound', count == 0);
10445
}
10446
10447
-
10447
function updateLoginTokens() {
10448
var x = '', count = 1;
10449
if ((loginTokens != null) && (loginTokens.length > 0)) {
webserver.js
+25
@@ -570,6 +570,31 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
570
}
571
});
572
}
573
+ } else if (name.startsWith('~t:')) {
574
+ // Login token, try to fetch the token from the database
575
+ obj.db.Get('logintoken-' + name, function (err, docs) {
576
+ if (err != null) { fn(err); return; }
577
+ if ((docs == null) || (docs.length != 1)) { fn(new Error('login token not found')); return; }
578
+ const loginToken = docs[0];
579
+ if ((loginToken.expire != 0) && (loginToken.expire < Date.now())) { fn(new Error('login token expired')); return; }
580
+
581
+ // Default strong password hashing (pbkdf2 SHA384)
582
+ require('./pass').hash(pass, loginToken.salt, function (err, hash, tag) {
583
+ if (err) return fn(err);
584
+ if (hash == loginToken.hash) {
585
+ // Login username and password are valid.
586
+ var user = obj.users[loginToken.userid];
587
+ if (!user) { fn(new Error('cannot find user')); return; }
588
+ if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
589
+
590
+ // Succesful login token authentication
591
+ var loginOptions = { logintoken: 1 };
592
+ if (loginToken.expire != 0) { loginOptions.expire = loginToken.expire; }
593
+ return fn(null, user._id, loginOptions);
594
+ }
595
+ fn(new Error('invalid password'));
596
+ }, 0);
597
+ });
598
} else {
599
// Regular login
600
var user = obj.users['user/' + domain.id + '/' + name.toLowerCase()];