Fixed permissions on uploading custom mesh core.
Ylian Saint-Hilaire committed
Feb 4, 2021 at 13:44 UTC
9ed135e08c2f71923890d84f656b01084fc17203
1 file changed
+18
-13
webserver.js
+18
-13
@@ -3317,22 +3317,27 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3317
if ((loginCookie != null) && (domain.id == loginCookie.domainid)) { authUserid = loginCookie.userid; } // Use cookie authentication
3318
}
3319
if (authUserid == null) { res.sendStatus(401); return; }
3320
+ if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
3321
3322
// Get the user
3323
const user = obj.users[authUserid];
3323
- if (user.siteadmin != 0xFFFFFFFF) { res.sendStatus(401); return; } // Check if we have mesh core upload rights (Full admin only)
3324
-
3325
- if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
3326
- for (var i in files.files) {
3327
- var file = files.files[i];
3328
- obj.fs.readFile(file.path, 'utf8', function (err, data) {
3329
- if (err != null) return;
3330
- data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
3331
- obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
3332
- try { obj.fs.unlinkSync(file.path); } catch (e) { }
3333
- });
3334
- }
3335
- res.send('');
3324
+ if (user == null) { res.sendStatus(401); return; } // Check this user exists
3325
+
3326
+ // Get the node and check node rights
3327
+ const nodeid = fields.attrib[0];
3328
+ obj.GetNodeWithRights(domain, user, nodeid, function (node, rights, visible) {
3329
+ if ((node == null) || (rights != 0xFFFFFFFF) || (visible == false)) { res.sendStatus(404); return; } // We don't have remote control rights to this device
3330
+ for (var i in files.files) {
3331
+ var file = files.files[i];
3332
+ obj.fs.readFile(file.path, 'utf8', function (err, data) {
3333
+ if (err != null) return;
3334
+ data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
3335
+ obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
3336
+ try { obj.fs.unlinkSync(file.path); } catch (e) { }
3337
+ });
3338
+ }
3339
+ res.send('');
3340
+ });
3341
});
3342
}
3343