Fixed invitation link encryption key.
Ylian Saint-Hilaire committed
Jun 7, 2019 at 17:11 UTC
74930c10df56ace070995ab11873ac3fc87eaa72
4 files changed
+13
-3
meshcentral.js
+10
@@ -59,6 +59,7 @@ function CreateMeshCentralServer(config, args) {
59
obj.currentVer = null;
60
obj.serverKey = Buffer.from(obj.crypto.randomBytes(48), 'binary');
61
obj.loginCookieEncryptionKey = null;
62
+ obj.invitationLinkEncryptionKey = null;
63
obj.serverSelfWriteAllowed = true;
64
obj.serverStatsCounter = Math.floor(Math.random() * 1000);
65
obj.taskLimiter = obj.common.createTaskLimiterQueue(50, 20, 60); // (maxTasks, maxTaskTime, cleaningInterval) This is a task limiter queue to smooth out server work.
@@ -836,6 +837,15 @@ function CreateMeshCentralServer(config, args) {
837
});
838
}
839
840
+ // Load the invitation link encryption key from the database
841
+ obj.db.Get('InvitationLinkEncryptionKey', function (err, docs) {
842
+ if ((docs.length > 0) && (docs[0].key != null) && (docs[0].key.length >= 160)) {
843
+ obj.invitationLinkEncryptionKey = Buffer.from(docs[0].key, 'hex');
844
+ } else {
845
+ obj.invitationLinkEncryptionKey = obj.generateCookieKey(); obj.db.Set({ _id: 'InvitationLinkEncryptionKey', key: obj.invitationLinkEncryptionKey.toString('hex'), time: Date.now() });
846
+ }
847
+ });
848
+
849
// Start collecting server stats every 5 minutes
850
setInterval(function () {
851
obj.serverStatsCounter++;
meshuser.js
+1
-1
@@ -2509,7 +2509,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
2509
if (common.validateInt(command.flags, 0, 256) == false) break; // Check the flags
2510
var mesh = parent.meshes[command.meshid];
2511
if (mesh == null) break;
2512
- const inviteCookie = parent.parent.encodeCookie({ a: 4, mid: command.meshid, f: command.flags, expire: command.expire * 60 }, parent.parent.loginCookieEncryptionKey);
2512
+ const inviteCookie = parent.parent.encodeCookie({ a: 4, mid: command.meshid, f: command.flags, expire: command.expire * 60 }, parent.parent.invitationLinkEncryptionKey);
2513
if (inviteCookie == null) break;
2514
ws.send(JSON.stringify({ action: 'createInviteLink', meshid: command.meshid, expire: command.expire, cookie: inviteCookie }));
2515
break;
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.3.6-h",
3
+ "version": "0.3.6-i",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+1
-1
@@ -1070,7 +1070,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1070
if ((domain == null) || ((req.query.m == null) && (req.query.c == null))) { res.sendStatus(404); return; }
1071
if (req.query.c != null) {
1072
// A cookie is specified in the query string, use that
1073
- var cookie = obj.parent.decodeCookie(req.query.c, obj.parent.loginCookieEncryptionKey);
1073
+ var cookie = obj.parent.decodeCookie(req.query.c, obj.parent.invitationLinkEncryptionKey);
1074
if (cookie == null) { res.sendStatus(404); return; }
1075
var mesh = obj.meshes[cookie.mid];
1076
if (mesh == null) { res.sendStatus(404); return; }