Fixed cross-domain + all device group admins.
Ylian Saint-Hilaire committed
Jun 26, 2020 at 15:38 UTC
5595c0665550ab9da357f46ddb2a98481f657048
1 file changed
+6
-1
meshuser.js
+6
-1
@@ -19,6 +19,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
19
const path = require('path');
20
const common = parent.common;
21
22
+ // Cross domain messages, for cross-domain administrators only.
23
+ const allowedCrossDomainMessages = ['accountcreate', 'accountremove', 'accountchange', 'createusergroup', 'deleteusergroup', 'usergroupchange'];
24
+
25
// User Consent Flags
26
const USERCONSENT_DesktopNotifyUser = 1;
27
const USERCONSENT_TerminalNotifyUser = 2;
@@ -284,7 +287,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
287
288
// Handle events
289
ws.HandleEvent = function (source, event, ids, id) {
287
- if ((event.domain == null) || (event.domain == domain.id) || (obj.crossDomain === true)) {
290
+ // Normally, only allow this user to receive messages from it's own domain.
291
+ // If the user is a cross domain administrator, allow some select messages from different domains.
292
+ if ((event.domain == null) || (event.domain == domain.id) || ((obj.crossDomain === true) && (allowedCrossDomainMessages.indexOf(event.action) >= 0))) {
293
try {
294
if (event == 'close') { try { delete req.session; } catch (ex) { } obj.close(); }
295
else if (event == 'resubscribe') { user.subscriptions = parent.subscribe(user._id, ws); }