Fixed device chat permissions.
Ylian Saint-Hilaire committed
Oct 15, 2019 at 16:26 UTC
98d81ba631d173a97b1dedd0d90e58f8a1de35b6
2 files changed
+23
-11
meshuser.js
+22
-10
@@ -1567,11 +1567,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1567
}
1568
case 'meshmessenger':
1569
{
1570
- // Send a notification message to a user
1571
- if ((user.siteadmin & 2) == 0) break;
1572
-
1570
// Setup a user-to-user session
1571
if (common.validateString(command.userid, 1, 2048)) {
1572
+ // Send a notification message to a user
1573
+ if ((user.siteadmin & 2) == 0) break;
1574
1575
// Can only perform this operation on other users of our group.
1576
var chguser = parent.users[command.userid];
@@ -1596,14 +1595,27 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1595
if (common.validateString(command.nodeid, 1, 2048)) {
1596
if (args.lanonly == true) { return; } // User-to-device chat is not support in LAN-only mode yet. We need the agent to replace the IP address of the server??
1597
1599
- // Create the server url
1600
- var httpsPort = ((args.aliasport == null) ? args.port : args.aliasport); // Use HTTPS alias port is specified
1601
- var xdomain = (domain.dns == null) ? domain.id : '';
1602
- if (xdomain != '') xdomain += "/";
1603
- var url = "http" + (args.notls ? '' : 's') + "://" + parent.getWebServerName(domain) + ":" + httpsPort + "/" + xdomain + "messenger?id=meshmessenger/" + encodeURIComponent(command.nodeid) + "/" + encodeURIComponent(user._id) + "&title=" + encodeURIComponent(user.name);
1598
+ // Get the device
1599
+ db.Get(command.nodeid, function (err, nodes) {
1600
+ if ((nodes == null) || (nodes.length != 1)) return;
1601
+ var node = nodes[0];
1602
1605
- // Create the notification message
1606
- routeCommandToNode({ "action": "openUrl", "nodeid": command.nodeid, "userid": user._id, "username": user.name, "url": url });
1603
+ // Get the mesh for this device
1604
+ mesh = parent.meshes[node.meshid];
1605
+ if (mesh) {
1606
+ // Check if this user has rights to do this
1607
+ if (mesh.links[user._id] == null || ((mesh.links[user._id].rights & MESHRIGHT_REMOTECONTROL) == 0)) return;
1608
+
1609
+ // Create the server url
1610
+ var httpsPort = ((args.aliasport == null) ? args.port : args.aliasport); // Use HTTPS alias port is specified
1611
+ var xdomain = (domain.dns == null) ? domain.id : '';
1612
+ if (xdomain != '') xdomain += "/";
1613
+ var url = "http" + (args.notls ? '' : 's') + "://" + parent.getWebServerName(domain) + ":" + httpsPort + "/" + xdomain + "messenger?id=meshmessenger/" + encodeURIComponent(command.nodeid) + "/" + encodeURIComponent(user._id) + "&title=" + encodeURIComponent(user.name);
1614
+
1615
+ // Create the notification message
1616
+ routeCommandToNode({ "action": "openUrl", "nodeid": command.nodeid, "userid": user._id, "username": user.name, "url": url });
1617
+ }
1618
+ });
1619
}
1620
1621
break;
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.2-o",
3
+ "version": "0.4.2-p",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",