Added func handlers for confirm,remove,verifyphone
Noah Zalev committed
Jan 8, 2022 at 15:11 UTC
8368c8e6411aa90b74e280d702846c47f5b20fab
1 file changed
+66
-65
meshuser.js
+66
-65
@@ -3564,70 +3564,6 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3564
delete obj.hardwareKeyRegistrationRequest;
3565
break;
3566
}
3567
- case 'verifyPhone': {
3568
- // Do not allow this command when logged in using a login token
3569
- if (req.session.loginToken != null) break;
3570
-
3571
- if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
3572
- if (parent.parent.smsserver == null) return;
3573
- if (common.validateString(command.phone, 1, 18) == false) break; // Check phone length
3574
- if (isPhoneNumber(command.phone) == false) break; // Check phone
3575
-
3576
- const code = common.zeroPad(getRandomSixDigitInteger(), 6)
3577
- const phoneCookie = parent.parent.encodeCookie({ a: 'verifyPhone', c: code, p: command.phone, s: ws.sessionId });
3578
- parent.parent.smsserver.sendPhoneCheck(domain, command.phone, code, parent.getLanguageCodes(req), function (success) {
3579
- ws.send(JSON.stringify({ action: 'verifyPhone', cookie: phoneCookie, success: success }));
3580
- });
3581
- break;
3582
- }
3583
- case 'confirmPhone': {
3584
- // Do not allow this command when logged in using a login token
3585
- if (req.session.loginToken != null) break;
3586
-
3587
- if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
3588
- if ((parent.parent.smsserver == null) || (typeof command.cookie != 'string') || (typeof command.code != 'string') || (obj.failedSmsCookieCheck == 1)) break; // Input checks
3589
- var cookie = parent.parent.decodeCookie(command.cookie);
3590
- if (cookie == null) break; // Invalid cookie
3591
- if (cookie.s != ws.sessionId) break; // Invalid session
3592
- if (cookie.c != command.code) {
3593
- obj.failedSmsCookieCheck = 1;
3594
- // Code does not match, delay the response to limit how many guesses we can make and don't allow more than 1 guess at any given time.
3595
- setTimeout(function () {
3596
- ws.send(JSON.stringify({ action: 'verifyPhone', cookie: command.cookie, success: true }));
3597
- delete obj.failedSmsCookieCheck;
3598
- }, 2000 + (parent.crypto.randomBytes(2).readUInt16BE(0) % 4095));
3599
- break;
3600
- }
3601
-
3602
- // Set the user's phone
3603
- user.phone = cookie.p;
3604
- db.SetUser(user);
3605
-
3606
- // Event the change
3607
- var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 96, msgArgs: [user.name], msg: 'Verified phone number of user ' + EscapeHtml(user.name), domain: domain.id };
3608
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
3609
- parent.parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
3610
-
3611
- break;
3612
- }
3613
- case 'removePhone': {
3614
- // Do not allow this command when logged in using a login token
3615
- if (req.session.loginToken != null) break;
3616
-
3617
- if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
3618
- if (user.phone == null) break;
3619
-
3620
- // Clear the user's phone
3621
- delete user.phone;
3622
- db.SetUser(user);
3623
-
3624
- // Event the change
3625
- var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 97, msgArgs: [user.name], msg: 'Removed phone number of user ' + EscapeHtml(user.name), domain: domain.id };
3626
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
3627
- parent.parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
3628
-
3629
- break;
3630
- }
3567
case 'smsuser': { // Send a SMS message to a user
3568
var errMsg = null, errId = 0, smsuser = null;
3569
if (parent.parent.smsserver == null) { errMsg = "SMS gateway not enabled"; errId = 23; }
@@ -5048,6 +4984,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
4984
'changeemail': serverCommandChangeEmail,
4985
'changelang': serverCommandChangeLang,
4986
'close': serverCommandClose,
4987
+ 'confirmPhone': serverCommandConfirmPhone,
4988
'files': serverCommandFiles,
4989
'getnetworkinfo': serverCommandGetNetworkInfo,
4990
'getsysinfo': serverCommandGetSysInfo,
@@ -5061,6 +4998,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
4998
'pong': serverCommandPong,
4999
'powertimeline': serverCommandPowerTimeline,
5000
'print': serverCommandPrint,
5001
+ 'removePhone': serverCommandremovePhone,
5002
'removeuserfromusergroup': serverCommandRemoveUserFromUserGroup,
5003
'serverclearerrorlog': serverCommandServerClearErrorLog,
5004
'serverconsole': serverCommandServerConsole,
@@ -5071,7 +5009,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5009
'serverversion': serverCommandServerVersion,
5010
'urlargs': serverCommandUrlArgs,
5011
'users': serverCommandUsers,
5074
- 'verifyemail': serverCommandVerifyEmail
5012
+ 'verifyemail': serverCommandVerifyEmail,
5013
+ 'verifyPhone': serverCommandVerifyPhone
5014
};
5015
5016
const serverUserCommands = {
@@ -5793,6 +5732,35 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5732
try { ws.close(); } catch (e) { }
5733
}
5734
5735
+ function serverCommandConfirmPhone(command) {
5736
+ // Do not allow this command when logged in using a login token
5737
+ if (req.session.loginToken != null) return;
5738
+
5739
+ if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
5740
+ if ((parent.parent.smsserver == null) || (typeof command.cookie != 'string') || (typeof command.code != 'string') || (obj.failedSmsCookieCheck == 1)) return; // Input checks
5741
+ var cookie = parent.parent.decodeCookie(command.cookie);
5742
+ if (cookie == null) return; // Invalid cookie
5743
+ if (cookie.s != ws.sessionId) return; // Invalid session
5744
+ if (cookie.c != command.code) {
5745
+ obj.failedSmsCookieCheck = 1;
5746
+ // Code does not match, delay the response to limit how many guesses we can make and don't allow more than 1 guess at any given time.
5747
+ setTimeout(function () {
5748
+ ws.send(JSON.stringify({ action: 'verifyPhone', cookie: command.cookie, success: true }));
5749
+ delete obj.failedSmsCookieCheck;
5750
+ }, 2000 + (parent.crypto.randomBytes(2).readUInt16BE(0) % 4095));
5751
+ return;
5752
+ }
5753
+
5754
+ // Set the user's phone
5755
+ user.phone = cookie.p;
5756
+ db.SetUser(user);
5757
+
5758
+ // Event the change
5759
+ var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 96, msgArgs: [user.name], msg: 'Verified phone number of user ' + EscapeHtml(user.name), domain: domain.id };
5760
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
5761
+ parent.parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
5762
+ }
5763
+
5764
function serverCommandFiles(command) {
5765
// Send the full list of server files to the browser app
5766
updateUserFiles(user, ws, domain);
@@ -5973,6 +5941,23 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5941
5942
function serverCommandPrint(command) { console.log(command.value); }
5943
5944
+ function serverCommandremovePhone(command) {
5945
+ // Do not allow this command when logged in using a login token
5946
+ if (req.session.loginToken != null) return;
5947
+
5948
+ if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
5949
+ if (user.phone == null) return;
5950
+
5951
+ // Clear the user's phone
5952
+ delete user.phone;
5953
+ db.SetUser(user);
5954
+
5955
+ // Event the change
5956
+ var event = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', msgid: 97, msgArgs: [user.name], msg: 'Removed phone number of user ' + EscapeHtml(user.name), domain: domain.id };
5957
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
5958
+ parent.parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
5959
+ }
5960
+
5961
function serverCommandRemoveUserFromUserGroup(command) {
5962
var err = null;
5963
try {
@@ -6154,6 +6139,22 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
6139
}
6140
}
6141
6142
+ function serverCommandVerifyPhone(command) {
6143
+ // Do not allow this command when logged in using a login token
6144
+ if (req.session.loginToken != null) return;
6145
+
6146
+ if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
6147
+ if (parent.parent.smsserver == null) return;
6148
+ if (common.validateString(command.phone, 1, 18) == false) return; // Check phone length
6149
+ if (isPhoneNumber(command.phone) == false) return; // Check phone
6150
+
6151
+ const code = common.zeroPad(getRandomSixDigitInteger(), 6);
6152
+ const phoneCookie = parent.parent.encodeCookie({ a: 'verifyPhone', c: code, p: command.phone, s: ws.sessionId });
6153
+ parent.parent.smsserver.sendPhoneCheck(domain, command.phone, code, parent.getLanguageCodes(req), function (success) {
6154
+ ws.send(JSON.stringify({ action: 'verifyPhone', cookie: phoneCookie, success: success }));
6155
+ });
6156
+ }
6157
+
6158
6159
function serverUserCommandHelp(cmdData) {
6160
var fin = '', f = '', availcommands = [];