Fixed permissions on uploading custom mesh core.

Ylian Saint-Hilaire committed Feb 4, 2021 at 13:44 UTC 9ed135e08c2f71923890d84f656b01084fc17203
1 file changed +18 -13
webserver.js
+18 -13
@@ -3317,22 +3317,27 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3317 if ((loginCookie != null) && (domain.id == loginCookie.domainid)) { authUserid = loginCookie.userid; } // Use cookie authentication
3318 }
3319 if (authUserid == null) { res.sendStatus(401); return; }
3320 + if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
3321
3322 // Get the user
3323 const user = obj.users[authUserid];
3323 - if (user.siteadmin != 0xFFFFFFFF) { res.sendStatus(401); return; } // Check if we have mesh core upload rights (Full admin only)
3324 -
3325 - if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
3326 - for (var i in files.files) {
3327 - var file = files.files[i];
3328 - obj.fs.readFile(file.path, 'utf8', function (err, data) {
3329 - if (err != null) return;
3330 - data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
3331 - obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
3332 - try { obj.fs.unlinkSync(file.path); } catch (e) { }
3333 - });
3334 - }
3335 - res.send('');
3324 + if (user == null) { res.sendStatus(401); return; } // Check this user exists
3325 +
3326 + // Get the node and check node rights
3327 + const nodeid = fields.attrib[0];
3328 + obj.GetNodeWithRights(domain, user, nodeid, function (node, rights, visible) {
3329 + if ((node == null) || (rights != 0xFFFFFFFF) || (visible == false)) { res.sendStatus(404); return; } // We don't have remote control rights to this device
3330 + for (var i in files.files) {
3331 + var file = files.files[i];
3332 + obj.fs.readFile(file.path, 'utf8', function (err, data) {
3333 + if (err != null) return;
3334 + data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
3335 + obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
3336 + try { obj.fs.unlinkSync(file.path); } catch (e) { }
3337 + });
3338 + }
3339 + res.send('');
3340 + });
3341 });
3342 }
3343