More code clean up and input validation.
Ylian Saint-Hilaire committed
Jul 6, 2020 at 15:04 UTC
984ce8b201c831e0fe1dd7ca0dfdb4e9669c9f8c
4 files changed
+9
-9
pluginHandler.js
+2
-2
@@ -516,7 +516,7 @@ module.exports.pluginHandler = function (parent) {
516
};
517
518
obj.handleAdminReq = function (req, res, user, serv) {
519
- if (obj.common.isAlphaNumeric(req.query.pin) !== true) { res.sendStatus(401); return; }
519
+ if ((req.query.pin == null) || (obj.common.isAlphaNumeric(req.query.pin) !== true)) { res.sendStatus(401); return; }
520
var path = obj.path.join(obj.pluginPath, req.query.pin, 'views');
521
if (obj.common.IsFilenameValid(path) !== true) { res.sendStatus(401); return; }
522
serv.app.set('views', path);
@@ -528,7 +528,7 @@ module.exports.pluginHandler = function (parent) {
528
}
529
530
obj.handleAdminPostReq = function (req, res, user, serv) {
531
- if (obj.common.isAlphaNumeric(req.query.pin) !== true) { res.sendStatus(401); return; }
531
+ if ((req.query.pin == null) || (obj.common.isAlphaNumeric(req.query.pin) !== true)) { res.sendStatus(401); return; }
532
var path = obj.path.join(obj.pluginPath, req.query.pin, 'views');
533
if (obj.common.IsFilenameValid(path) !== true) { res.sendStatus(401); return; }
534
serv.app.set('views', path);
views/login-mobile.handlebars
+1
-1
@@ -327,7 +327,7 @@
327
328
// Display the right server message
329
var messageid = parseInt('{{{messageid}}}');
330
- var okmessages = ['', "Hold on, reset mail sent.", "Email sent.", "Email verification required, check your mailbox and click the confirmation link.", "SMS sent."];
330
+ var okmessages = ['', "If valid, reset mail sent.", "Email sent.", "Email verification required, check your mailbox and click the confirmation link.", "SMS sent."];
331
var failmessages = ["Unable to create account.", "Account limit reached.", "Existing account with this email address.", "Invalid account creation token.", "Username already exists.", "Password rejected, use a different one.", "Invalid email.", "Account not found.", "Invalid token, try again.", "Unable to sent email.", "Account locked.", "Access denied.", "Login failed, check username and password.", "Password change requested.", "IP address blocked, try again later."];
332
if (messageid > 0) {
333
var msg = '';
views/login.handlebars
+1
-1
@@ -320,7 +320,7 @@
320
// Display the right server message
321
var i;
322
var messageid = parseInt('{{{messageid}}}');
323
- var okmessages = ['', "Hold on, reset mail sent.", "Email sent.", "Email verification required, check your mailbox and click the confirmation link.", "SMS sent."];
323
+ var okmessages = ['', "If valid, reset mail sent.", "Email sent.", "Email verification required, check your mailbox and click the confirmation link.", "SMS sent."];
324
var failmessages = ["Unable to create account.", "Account limit reached.", "Existing account with this email address.", "Invalid account creation token.", "Username already exists.", "Password rejected, use a different one.", "Invalid email.", "Account not found.", "Invalid token, try again.", "Unable to sent email.", "Account locked.", "Access denied.", "Login failed, check username and password.", "Password change requested.", "IP address blocked, try again later."];
325
if (messageid > 0) {
326
var msg = '';
webserver.js
+5
-5
@@ -1357,7 +1357,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1357
if ((err != null) || (docs.length == 0)) {
1358
parent.debug('web', 'handleResetAccountRequest: Account not found');
1359
req.session.loginmode = '3';
1360
- req.session.messageid = 107; // Account not found.
1360
+ req.session.messageid = 1; // If valid, reset mail sent. Instead of "Account not found" (107), we send this hold on message so users can't know if this account exists or not.
1361
if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1362
} else {
1363
// If many accounts have the same validated e-mail, we are going to use the first one for display, but sent a reset email for all accounts.
@@ -1388,7 +1388,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1388
if (i == 0) {
1389
parent.debug('web', 'handleResetAccountRequest: Hold on, reset mail sent.');
1390
req.session.loginmode = '1';
1391
- req.session.messageid = 1; // Hold on, reset mail sent.
1391
+ req.session.messageid = 1; // If valid, reset mail sent.
1392
if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1393
}
1394
} else {
@@ -1408,7 +1408,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1408
if (i == 0) {
1409
parent.debug('web', 'handleResetAccountRequest: Hold on, reset mail sent.');
1410
req.session.loginmode = '1';
1411
- req.session.messageid = 1; // Hold on, reset mail sent.
1411
+ req.session.messageid = 1; // If valid, reset mail sent.
1412
if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1413
}
1414
} else {
@@ -2828,7 +2828,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2828
if (domain == null) return;
2829
2830
// Check the query
2831
- if ((req.query.file == null) || (obj.common.IsFilenameValid(req.query.file) !== true)) { res.sendStatus(401); return; }
2831
+ if ((domain.sessionrecording == null) || (req.query.file == null) || (obj.common.IsFilenameValid(req.query.file) !== true)) { res.sendStatus(401); return; }
2832
2833
// Get the recording path
2834
var recordingsPath = null;
@@ -2923,7 +2923,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2923
} catch (ex) {
2924
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=\"file.bin\"' });
2925
}
2926
- try { res.sendFile(file.fullpath); } catch (e) { res.sendStatus(404); }
2926
+ obj.fs.exists(file.fullpath, function (exists) { if (exists == true) { res.sendFile(file.fullpath); } else { res.sendStatus(404); } });
2927
}
2928
2929
// Upload a MeshCore.js file to the server