Fixed self device group permission change and agent group uninstall.
Ylian Saint-Hilaire committed
Oct 26, 2019 at 10:57 UTC
84a37b4f5aad0a31a4852e5c6590515651525941
6 files changed
+14
-16
meshuser.js
+9
-7
@@ -1838,6 +1838,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1838
for (var i in command.usernames) {
1839
// Check if the user exists
1840
var newuserid = 'user/' + domain.id + '/' + command.usernames[i].toLowerCase(), newuser = parent.users[newuserid];
1841
+ if (newuserid == obj.user._id) { continue; } // Can't add or modify self
1842
if (newuser != null) {
1843
// Add mesh to user
1844
if (newuser.links == null) newuser.links = {};
@@ -1872,18 +1873,19 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1873
{
1874
var err = null;
1875
try {
1875
- if (common.validateString(command.userid, 1, 1024) == false) { err = 'Invalid userid'; } // Check userid
1876
- if (common.validateString(command.meshid, 1, 1024) == false) { err = 'Invalid groupid'; } // Check meshid
1876
+ if (common.validateString(command.userid, 1, 1024) == false) { err = "Invalid userid"; } // Check userid
1877
+ if (common.validateString(command.meshid, 1, 1024) == false) { err = "Invalid groupid"; } // Check meshid
1878
if (command.userid.indexOf('/') == -1) { command.userid = 'user/' + domain.id + '/' + command.userid; }
1878
- if ((command.userid.split('/').length != 3) || (command.userid.split('/')[1] != domain.id)) { err = 'Invalid userid'; } // Invalid domain, operation only valid for current domain
1879
+ if (command.userid == obj.user._id) { err = "Can't remove self"; } // Can't add of modify self
1880
+ if ((command.userid.split('/').length != 3) || (command.userid.split('/')[1] != domain.id)) { err = "Invalid userid"; } // Invalid domain, operation only valid for current domain
1881
else {
1882
if (command.meshid.indexOf('/') == -1) { command.meshid = 'mesh/' + domain.id + '/' + command.meshid; }
1883
mesh = parent.meshes[command.meshid];
1882
- if (mesh == null) { err = 'Unknown device group'; }
1883
- else if (mesh.links[user._id] == null || ((mesh.links[user._id].rights & 2) == 0)) { err = 'Permission denied'; }
1884
- else if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) { err = 'Invalid domain'; } // Invalid domain, operation only valid for current domain
1884
+ if (mesh == null) { err = "Unknown device group"; }
1885
+ else if (mesh.links[user._id] == null || ((mesh.links[user._id].rights & 2) == 0)) { err = "Permission denied"; }
1886
+ else if ((command.meshid.split('/').length != 3) || (command.meshid.split('/')[1] != domain.id)) { err = "Invalid domain"; } // Invalid domain, operation only valid for current domain
1887
}
1886
- } catch (ex) { err = 'Validation exception: ' + ex; }
1888
+ } catch (ex) { err = "Validation exception: " + ex; }
1889
1890
// Handle any errors
1891
if (err != null) {
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.3-f",
3
+ "version": "0.4.3-g",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
views/default-min.handlebars
+1
-2
@@ -2349,11 +2349,10 @@
2349
}
2350
2351
function groupActionFunction() {
2352
- var addedOptions = '';
2352
+ var addedOptions = '', nodeids = getCheckedDevices();
2353
2354
// Check if any of the selected devices have a MQTT connection active
2355
if (features & 0x00400000) {
2356
- var nodeids = getCheckedDevices();
2356
for (var i in nodeids) { if ((getNodeFromId(nodeids[i]).conn & 16) != 0) { addedOptions += '<option value=103>' + "Send MQTT Message" + '</option>'; break; } }
2357
}
2358
views/default.handlebars
+1
-2
@@ -3331,11 +3331,10 @@
3331
}
3332
3333
function groupActionFunction() {
3334
- var addedOptions = '';
3334
+ var addedOptions = '', nodeids = getCheckedDevices();
3335
3336
// Check if any of the selected devices have a MQTT connection active
3337
if (features & 0x00400000) {
3338
- var nodeids = getCheckedDevices();
3338
for (var i in nodeids) { if ((getNodeFromId(nodeids[i]).conn & 16) != 0) { addedOptions += '<option value=103>' + "Send MQTT Message" + '</option>'; break; } }
3339
}
3340
views/translations/default-min_fr.handlebars
+1
-2
@@ -2349,11 +2349,10 @@
2349
}
2350
2351
function groupActionFunction() {
2352
- var addedOptions = '';
2352
+ var addedOptions = '', nodeids = getCheckedDevices();
2353
2354
// Check if any of the selected devices have a MQTT connection active
2355
if (features & 0x00400000) {
2356
- var nodeids = getCheckedDevices();
2356
for (var i in nodeids) { if ((getNodeFromId(nodeids[i]).conn & 16) != 0) { addedOptions += '<option value=103>' + "Envoyer un Message MQTT" + '</option>'; break; } }
2357
}
2358
views/translations/default_fr.handlebars
+1
-2
@@ -3329,11 +3329,10 @@
3329
}
3330
3331
function groupActionFunction() {
3332
- var addedOptions = '';
3332
+ var addedOptions = '', nodeids = getCheckedDevices();
3333
3334
// Check if any of the selected devices have a MQTT connection active
3335
if (features & 0x00400000) {
3336
- var nodeids = getCheckedDevices();
3336
for (var i in nodeids) { if ((getNodeFromId(nodeids[i]).conn & 16) != 0) { addedOptions += '<option value=103>' + "Envoyer un Message MQTT" + '</option>'; break; } }
3337
}
3338