Meshctrl.js now shows access denies if you can't access users list.
Ylian Saint-Hilaire committed
Jun 12, 2020 at 13:04 UTC
89e126b9766def5eb1e62964643bf02689091a1c
2 files changed
+7
-6
meshctrl.js
+6
-5
@@ -611,11 +611,11 @@ function serverConnect() {
611
switch (settings.cmd) {
612
case 'serverinfo': { break; }
613
case 'userinfo': { break; }
614
- case 'listusers': { ws.send(JSON.stringify({ action: 'users' })); break; }
615
- case 'listusersessions': { ws.send(JSON.stringify({ action: 'wssessioncount' })); }
616
- case 'listusergroups': { ws.send(JSON.stringify({ action: 'usergroups' })); }
617
- case 'listdevicegroups': { ws.send(JSON.stringify({ action: 'meshes' })); break; }
618
- case 'listusersofdevicegroup': { ws.send(JSON.stringify({ action: 'meshes' })); break; }
614
+ case 'listusers': { ws.send(JSON.stringify({ action: 'users', responseid: 'meshctrl' })); break; }
615
+ case 'listusersessions': { ws.send(JSON.stringify({ action: 'wssessioncount', responseid: 'meshctrl' })); }
616
+ case 'listusergroups': { ws.send(JSON.stringify({ action: 'usergroups', responseid: 'meshctrl' })); }
617
+ case 'listdevicegroups': { ws.send(JSON.stringify({ action: 'meshes', responseid: 'meshctrl' })); break; }
618
+ case 'listusersofdevicegroup': { ws.send(JSON.stringify({ action: 'meshes', responseid: 'meshctrl' })); break; }
619
case 'listdevices': {
620
if (args.group) {
621
ws.send(JSON.stringify({ action: 'nodes', meshname: args.group, responseid: 'meshctrl' }));
@@ -885,6 +885,7 @@ function serverConnect() {
885
break;
886
}
887
case 'users': { // LISTUSERS
888
+ if (data.result) { console.log(data.result); process.exit(); return; }
889
if (args.filter) {
890
// Filter the list of users
891
var filters = args.filter.toLowerCase().split(',');
meshuser.js
+1
-1
@@ -1291,7 +1291,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1291
case 'users':
1292
{
1293
// Request a list of all users
1294
- if ((user.siteadmin & 2) == 0) break;
1294
+ if ((user.siteadmin & 2) == 0) { if (command.responseid != null) { try { ws.send(JSON.stringify({ action: 'users', responseid: command.responseid, result: 'Access denied' })); } catch (ex) { } } break; }
1295
var docs = [];
1296
for (i in parent.users) {
1297
if (((obj.crossDomain === true) || (parent.users[i].domain == domain.id)) && (parent.users[i].name != '~')) {