Fixes for SSO accounts and server peering.

Ylian Saint-Hilaire committed Nov 28, 2020 at 18:03 UTC 67b748d1e61765beeebda83766751754c4774142
2 files changed +23 -10
db.js
+2 -1
@@ -1615,6 +1615,7 @@ module.exports.CreateDB = function (parent, func) {
1615 // Called when a user account has changed
1616 function dbUserChange(userChange, added) {
1617 if (parent.webserver == null) return;
1618 + common.unEscapeLinksFieldName(userChange.fullDocument);
1619 const user = performTypedRecordDecrypt([userChange.fullDocument])[0];
1620
1621 // Update the user object in memory
@@ -1635,7 +1636,7 @@ module.exports.CreateDB = function (parent, func) {
1636 const usergroup = ugrpChange.fullDocument;
1637
1638 // Update the user group object in memory
1638 - const uusergroup = parent.webserver.usergroups[usergroup._id];
1639 + const uusergroup = parent.webserver.userGroups[usergroup._id];
1640 for (var i in usergroup) { uusergroup[i] = usergroup[i]; }
1641 for (var i in uusergroup) { if (usergroup[i] == null) { delete uusergroup[i]; } }
1642
meshuser.js
+21 -9
@@ -1380,7 +1380,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1380 // User filtered events
1381 if ((command.user != null) && ((user.siteadmin & 2) != 0)) { // SITERIGHT_MANAGEUSERS
1382 // TODO: Add the meshes command.user has access to (???)
1383 - var filter = ['user/' + domain.id + '/' + command.user.toLowerCase()];
1383 + var filter = ['user/' + domain.id + '/' + command.user];
1384 if ((command.limit == null) || (typeof command.limit != 'number')) {
1385 // Send the list of all events for this session
1386 db.GetUserEvents(filter, domain.id, command.user, function (err, docs) {
@@ -1501,10 +1501,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1501
1502 if (common.validateString(command.lang, 1, 6) == false) return;
1503
1504 - // Always lowercase the email address
1504 + // Always lowercase the language
1505 command.lang = command.lang.toLowerCase();
1506
1507 - // Update the user's email
1507 + // Update the user's language
1508 var oldlang = user.lang;
1509 if (command.lang == '*') { delete user.lang; } else { user.lang = command.lang; }
1510 parent.db.SetUser(user);
@@ -1824,7 +1824,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1824 } else {
1825 for (var i in command.users) {
1826 // Check if this is an existing user
1827 - var newuserid = 'user/' + domain.id + '/' + command.users[i].user.toLowerCase();
1827 + var newuserid = 'user/' + domain.id + '/' + command.users[i].user;
1828 var newuser = { type: 'user', _id: newuserid, name: command.users[i].user, creation: Math.floor(Date.now() / 1000), domain: domain.id };
1829 if (domain.newaccountsrights) { newuser.siteadmin = domain.newaccountsrights; }
1830 if (command.users[i].email != null) { newuser.email = command.users[i].email.toLowerCase(); if (command.users[i].emailVerified === true) { newuser.emailVerified = true; } } // Email, always lowercase
@@ -2347,7 +2347,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2347 var unknownUsers = [], addedCount = 0, failCount = 0;
2348 for (var i in command.usernames) {
2349 // Check if the user exists
2350 - var chguserid = 'user/' + addUserDomain.id + '/' + command.usernames[i].toLowerCase(), chguser = parent.users[chguserid];
2350 + var chguserid = 'user/' + addUserDomain.id + '/' + command.usernames[i].toLowerCase();
2351 + var chguser = parent.users[chguserid];
2352 + if (chguser == null) { chguserid = 'user/' + addUserDomain.id + '/' + command.usernames[i]; chguser = parent.users[chguserid]; }
2353 if (chguser != null) {
2354 // Add mesh to user
2355 if (chguser.links == null) { chguser.links = {}; }
@@ -2362,7 +2364,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2364 parent.parent.DispatchEvent(targets, obj, event);
2365
2366 // Add a user to the user group
2365 - group.links[chguserid] = { userid: chguser.id, name: chguser.name, rights: 1 };
2367 + group.links[chguserid] = { userid: chguser._id, name: chguser.name, rights: 1 };
2368 addedCount++;
2369 } else {
2370 unknownUsers.push(command.usernames[i]);
@@ -2415,7 +2417,11 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2417 }
2418
2419 // Check if the user exists
2418 - if (command.userid.startsWith('user/') == false) { command.userid = 'user/' + removeUserDomain.id + '/' + command.userid.toLowerCase(); }
2420 + if (command.userid.startsWith('user/') == false) {
2421 + if (parent.users['user/' + removeUserDomain.id + '/' + command.userid.toLowerCase()] != null) { command.userid = 'user/' + removeUserDomain.id + '/' + command.userid.toLowerCase(); }
2422 + else if (parent.users['user/' + removeUserDomain.id + '/' + command.userid] != null) { command.userid = 'user/' + removeUserDomain.id + '/' + command.userid; }
2423 + }
2424 +
2425 var chguser = parent.users[command.userid];
2426 if (chguser != null) {
2427 var change = false;
@@ -2993,7 +2999,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2999 // Convert user names to userid's
3000 if (command.userids == null) {
3001 command.userids = [];
2996 - for (var i in command.usernames) { command.userids.push('user/' + domain.id + '/' + command.usernames[i].toLowerCase()); }
3002 + for (var i in command.usernames) {
3003 + if (parent.users['user/' + domain.id + '/' + command.usernames[i].toLowerCase()] != null) { command.userids.push('user/' + domain.id + '/' + command.usernames[i].toLowerCase()); }
3004 + else if (parent.users['user/' + domain.id + '/' + command.usernames[i]] != null) { command.userids.push('user/' + domain.id + '/' + command.usernames[i]); }
3005 + }
3006 }
3007 var unknownUsers = [], successCount = 0, failCount = 0, msgs = [];
3008 for (var i in command.userids) {
@@ -3108,7 +3117,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3117 if (command.userids == null) {
3118 command.userids = [];
3119 for (var i in command.usernames) {
3111 - if (command.usernames[i] != null) { command.userids.push('user/' + domain.id + '/' + command.usernames[i].toLowerCase()); }
3120 + if (command.usernames[i] != null) {
3121 + if (parent.users['user/' + domain.id + '/' + command.usernames[i].toLowerCase()] != null) { command.userids.push('user/' + domain.id + '/' + command.usernames[i].toLowerCase()); }
3122 + else if (parent.users['user/' + domain.id + '/' + command.usernames[i]] != null) { command.userids.push('user/' + domain.id + '/' + command.usernames[i]); }
3123 + }
3124 }
3125 }
3126