Access control fixes.
Ylian Saint-Hilaire committed
Apr 14, 2020 at 20:05 UTC
96f5845e24e605dbbf11c0ec73d8b51c9a0d521a
2 files changed
+45
-9
views/default-mobile.handlebars
+21
-3
@@ -991,7 +991,7 @@
991
nodes = newnodes;
992
993
// If we are looking at a node in the deleted mesh, move back to "My Devices"
994
- if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && currentNode.meshid == message.event.meshid) { setDialogMode(0); go(2); }
994
+ if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && !IsNodeViewable(currentNode)) { setDialogMode(0); go(2); currentNode = null; }
995
}
996
}
997
updateMeshes();
@@ -1019,7 +1019,7 @@
1019
// If we are looking at a mesh that is now deleted, move back to "My Account"
1020
if (xxcurrentView >= 20 && xxcurrentView < 30 && currentMesh._id == message.event.meshid) { setDialogMode(0); go(2); }
1021
// If we are looking at a node in the deleted mesh, move back to "My Devices"
1022
- if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && currentNode.meshid == message.event.meshid) { setDialogMode(0); go(2); }
1022
+ if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && !IsNodeViewable(currentNode)) { setDialogMode(0); go(2); }
1023
1024
break;
1025
}
@@ -1117,7 +1117,7 @@
1117
// We don't see the new mesh, remove this device
1118
1119
// TODO: Correctly disconnect from this node (Desktop/Terminal/Files...)
1120
- if (currentNode == node) { if (xxcurrentView >= 10 && xxcurrentView < 20) { setDialogMode(0); go(2); } currentNode = null; }
1120
+ if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && !IsNodeViewable(currentNode)) { setDialogMode(0); go(2); currentNode = null; }
1121
nodes.splice(index, 1);
1122
} else {
1123
// We see the new mesh, move this device
@@ -3560,6 +3560,24 @@
3560
return r;
3561
}
3562
3563
+ // Return true if the device is visible to the user
3564
+ function IsNodeViewable(node, userid) {
3565
+ if (node == null) { return false; }
3566
+ if (userid == null) { userid = userinfo._id; }
3567
+ if (typeof node == 'string') { node = getNodeFromId(node); if (node == null) { return false; } }
3568
+ if (IsMeshViewable(node.meshid, userid)) return true;
3569
+
3570
+ // Check direct device visibility using device data
3571
+ if ((node.links != null) && (node.links[userid] != null)) { return true; }
3572
+
3573
+ // Check direct device visibility thru user groups
3574
+ if ((node.links != null) && (userinfo.links != null)) {
3575
+ for (var i in node.links) { if (i.startsWith('ugrp/') && (userinfo.links[i] != null) && (node.links[i].rights != null)) { return true; } }
3576
+ }
3577
+
3578
+ return false;
3579
+ }
3580
+
3581
//
3582
// Generic Methods
3583
//
views/default.handlebars
+24
-6
@@ -1836,7 +1836,7 @@
1836
}
1837
1838
// If we are currently looking at a node this is now gone, change the view.
1839
- if ((currentNode != null) && (getNodeFromId(currentNode._id) == null)) { currentNode = null; go(1); }
1839
+ if ((currentNode != null) && (IsNodeViewable(currentNode) == false)) { currentNode = null; go(1); }
1840
1841
// Change the reference to the current node
1842
if (currentNode != null) { currentNode = getNodeFromId(currentNode._id); }
@@ -2345,12 +2345,12 @@
2345
for (var i in nodes) { if ((nodes[i].meshid != message.event.meshid) || ((userinfo.links != null) && (userinfo.links[nodes[i]._id] != null))) { newnodes.push(nodes[i]); } }
2346
nodes = newnodes;
2347
2348
- // If we are looking at a node in the deleted mesh, move back to "My Devices"
2349
- if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && currentNode.meshid == message.event.meshid) { setDialogMode(0); go(1); }
2348
+ // If we are looking at a node that is no longer visible, move back to "My Devices"
2349
+ if ((xxcurrentView >= 10) && (xxcurrentView < 20) && currentNode && !IsNodeViewable(currentNode)) { setDialogMode(0); go(1); }
2350
}
2351
}
2352
masterUpdate(4 + 128 + 8192 + 16384);
2353
- if (currentNode && (currentNode.meshid == message.event.meshid)) { currentNode = null; if ((xxcurrentView >= 10) && (xxcurrentView < 20)) { go(1); } }
2353
+ if (currentNode && !IsNodeViewable(currentNode)) { currentNode = null; if ((xxcurrentView >= 10) && (xxcurrentView < 20)) { go(1); } }
2354
//meshserver.send({ action: 'files' }); // TODO: Why do we need to do this??
2355
2356
// If we are looking at a mesh that is now deleted, move back to "My Account"
@@ -2374,7 +2374,7 @@
2374
// If we are looking at a mesh that is now deleted, move back to "My Account"
2375
if (xxcurrentView >= 20 && xxcurrentView < 30 && currentMesh._id == message.event.meshid) { setDialogMode(0); go(2); }
2376
// If we are looking at a node in the deleted mesh, move back to "My Devices"
2377
- if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && currentNode.meshid == message.event.meshid) { setDialogMode(0); go(1); }
2377
+ if (xxcurrentView >= 10 && xxcurrentView < 20 && currentNode && !IsNodeViewable(currentNode)) { setDialogMode(0); go(1); }
2378
break;
2379
}
2380
case 'addnode': {
@@ -2476,7 +2476,7 @@
2476
// We don't see the new mesh, remove this device
2477
2478
// TODO: Correctly disconnect from this node (Desktop/Terminal/Files...)
2479
- if (currentNode == node) { if (xxcurrentView >= 10 && xxcurrentView < 20) { setDialogMode(0); go(1); } currentNode = null; }
2479
+ if ((xxcurrentView >= 10) && (xxcurrentView < 20) && !IsNodeViewable(currentNode)) { currentNode = null; setDialogMode(0); go(1); }
2480
nodes.splice(index, 1);
2481
masterUpdate(4 | 16);
2482
} else {
@@ -11820,6 +11820,24 @@
11820
return r;
11821
}
11822
11823
+ // Return true if the device is visible to the user
11824
+ function IsNodeViewable(node, userid) {
11825
+ if (node == null) { return false; }
11826
+ if (userid == null) { userid = userinfo._id; }
11827
+ if (typeof node == 'string') { node = getNodeFromId(node); if (node == null) { return false; } }
11828
+ if (IsMeshViewable(node.meshid, userid)) return true;
11829
+
11830
+ // Check direct device visibility using device data
11831
+ if ((node.links != null) && (node.links[userid] != null)) { return true; }
11832
+
11833
+ // Check direct device visibility thru user groups
11834
+ if ((node.links != null) && (userinfo.links != null)) {
11835
+ for (var i in node.links) { if (i.startsWith('ugrp/') && (userinfo.links[i] != null) && (node.links[i].rights != null)) { return true; } }
11836
+ }
11837
+
11838
+ return false;
11839
+ }
11840
+
11841
//
11842
// Generic methods
11843
//