Improved uicustomevent security and events, #3823
Ylian Saint-Hilaire committed
Mar 30, 2022 at 07:14 UTC
5a81c84d67df3bd705b5d159b9ce2dbb05d71c1c
3 files changed
+43
-9
meshuser.js
+25
-7
@@ -4244,13 +4244,31 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
4244
break;
4245
}
4246
case 'uicustomevent': {
4247
- // Event the custom UI action
4248
- var message = { etype: 'user', userid: user._id, username: user.name, action: 'uicustomevent', domain: domain.id, uisection: command.section, element: command.element };
4249
- if (command.selectedDevices != null) { message.selectedDevices = command.selectedDevices; }
4250
- if (command.src != null) { message.src = command.src; }
4251
- if (command.values != null) { message.values = command.values; }
4252
- if (typeof command.logmsg == 'string') { message.msg = command.logmsg; } else { message.nolog = 1; }
4253
- parent.parent.DispatchEvent(['*', user._id], obj, message);
4247
+ if ((command.src != null) && (Array.isArray(command.src.selectedDevices))) {
4248
+ // Contains a list of nodeid's, check that we have permissions for them.
4249
+ parent.GetNodesWithRights(domain, user, command.src.selectedDevices, function (nodes) {
4250
+ var nodeids = [];
4251
+ for (var i in nodes) { nodeids.push(i); }
4252
+ if (nodeids.length == 0) return;
4253
+
4254
+ // Event the custom UI action
4255
+ var message = { etype: 'user', userid: user._id, username: user.name, action: 'uicustomevent', domain: domain.id, uisection: command.section, element: command.element };
4256
+ if (nodeids.length == 1) { message.nodeid = nodeids[0]; }
4257
+ if (command.selectedDevices != null) { message.selectedDevices = command.selectedDevices; }
4258
+ if (command.src != null) { message.src = command.src; }
4259
+ if (command.values != null) { message.values = command.values; }
4260
+ if (typeof command.logmsg == 'string') { message.msg = command.logmsg; } else { message.nolog = 1; }
4261
+ parent.parent.DispatchEvent(['*', user._id], obj, message);
4262
+ });
4263
+ } else {
4264
+ // Event the custom UI action
4265
+ var message = { etype: 'user', userid: user._id, username: user.name, action: 'uicustomevent', domain: domain.id, uisection: command.section, element: command.element };
4266
+ if (command.selectedDevices != null) { message.selectedDevices = command.selectedDevices; }
4267
+ if (command.src != null) { message.src = command.src; }
4268
+ if (command.values != null) { message.values = command.values; }
4269
+ if (typeof command.logmsg == 'string') { message.msg = command.logmsg; } else { message.nolog = 1; }
4270
+ parent.parent.DispatchEvent(['*', user._id], obj, message);
4271
+ }
4272
break;
4273
}
4274
case 'serverBackup': {
views/default.handlebars
+6
-2
@@ -10597,8 +10597,12 @@
10597
if (xevent) {
10598
var x = '<div style=overflow-y:auto;max-height:300px>';
10599
for (var i in xevent) {
10600
- if ((i == 'h') || (i == '_id') || (i == 'ids') || (i == 'domain') || (xevent[i] == null) || (typeof xevent[i] == 'object')) continue;
10601
- x += addHtmlValue3(EscapeHtml(i), EscapeHtml(xevent[i]));
10600
+ if ((i == 'h') || (i == '_id') || (i == 'ids') || (i == 'domain') || (xevent[i] == null)) continue;
10601
+ if (typeof xevent[i] == 'object') {
10602
+ x += addHtmlValue3(EscapeHtml(i), EscapeHtml(JSON.stringify(xevent[i])));
10603
+ } else {
10604
+ x += addHtmlValue3(EscapeHtml(i), EscapeHtml(xevent[i]));
10605
+ }
10606
}
10607
x += '</div>';
10608
setDialogMode(2, "Event Details", 9, null, x);
webserver.js
+12
@@ -7158,6 +7158,18 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
7158
return rights;
7159
}
7160
7161
+
7162
+ // Return the node and rights for a array of nodeids
7163
+ obj.GetNodesWithRights = function (domain, user, nodeids, func) {
7164
+ var rc = nodeids.length, r = {};
7165
+ for (var i in nodeids) {
7166
+ obj.GetNodeWithRights(domain, user, nodeids[i], function (node, rights, visible) {
7167
+ if ((node != null) && (visible == true)) { r[node._id] = { node: node, rights: rights }; if (--rc == 0) { func(r); } }
7168
+ });
7169
+ }
7170
+ }
7171
+
7172
+
7173
// Return the node and rights for a given nodeid
7174
obj.GetNodeWithRights = function (domain, user, nodeid, func) {
7175
// Perform user pre-validation