Removed SSPI auth retrieveGroups to reduce cookie size.
Ylian Saint-Hilaire committed
Sep 2, 2021 at 17:52 UTC
8b93655638db7535eddd85e008087c755d3086cf
2 files changed
+7
-4
views/default-mobile.handlebars
+2
-1
@@ -6168,7 +6168,8 @@
6168
else if (n.tag == 'console') gotoDevice(n.nodeid, 15); // Files
6169
else gotoDevice(n.nodeid, 10); // General
6170
} else {
6171
- if ((n.tag != null) && n.tag.startsWith('meshmessenger/')) {
6171
+ if ((n.tag == 'backupcodes') && !xxdialogMode) { account_manageOtp(0); notificationDelete(id); } // 2FA backup codes
6172
+ else if ((n.tag != null) && n.tag.startsWith('meshmessenger/')) {
6173
safeNewWindow('/messenger?id=' + n.tag + '&title=' + encodeURIComponentEx(n.username), n.tag.split('/')[2]);
6174
notificationDelete(id);
6175
} else if (n.url != null) {
webserver.js
+5
-3
@@ -125,7 +125,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
125
126
// Setup SSPI authentication if needed
127
if ((obj.parent.platform == 'win32') && (obj.args.nousers != true) && (obj.parent.config != null) && (obj.parent.config.domains != null)) {
128
- for (i in obj.parent.config.domains) { if (obj.parent.config.domains[i].auth == 'sspi') { var nodeSSPI = require('node-sspi'); obj.parent.config.domains[i].sspi = new nodeSSPI({ retrieveGroups: true, offerBasic: false }); } }
128
+ for (i in obj.parent.config.domains) { if (obj.parent.config.domains[i].auth == 'sspi') { var nodeSSPI = require('node-sspi'); obj.parent.config.domains[i].sspi = new nodeSSPI({ retrieveGroups: false, offerBasic: false }); } }
129
}
130
131
// Perform hash on web certificate and agent certificate
@@ -2454,7 +2454,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2454
} else if (req.query.user && req.query.pass) {
2455
// User credentials are being passed in the URL. WARNING: Putting credentials in a URL is bad security... but people are requesting this option.
2456
obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) {
2457
- if (obj.parent.authlog) { obj.parent.authLog('https', 'Accepted password for ' + req.connection.user + ' from ' + req.clientIp + ' port ' + req.connection.remotePort); }
2457
+ if (obj.parent.authlog) { obj.parent.authLog('https', 'Accepted password for ' + userid + ' from ' + req.clientIp + ' port ' + req.connection.remotePort); }
2458
parent.debug('web', 'handleRootRequest: user/pass in URL auth ok.');
2459
req.session.userid = userid;
2460
delete req.session.currentNode;
@@ -4869,8 +4869,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4869
if (user == null) { try { res.sendStatus(404); } catch (ex) { } return; }
4870
}
4871
if ((req.query.meshaction == 'route') && (req.query.nodeid != null)) {
4872
+ var nodeIdSplit = req.query.nodeid.split('/');
4873
+ if ((nodeIdSplit[0] != 'node') || (nodeIdSplit[1] != domain.id)) { try { res.sendStatus(401); } catch (ex) { } return; }
4874
obj.db.Get(req.query.nodeid, function (err, nodes) {
4873
- if (nodes.length != 1) { try { res.sendStatus(401); } catch (ex) { } return; }
4875
+ if ((err != null) || (nodes.length != 1)) { try { res.sendStatus(401); } catch (ex) { } return; }
4876
var node = nodes[0];
4877
4878
// Create the meshaction.txt file for meshcmd.exe