Factor changeemail, verifyemail
Noah Zalev committed
Dec 8, 2021 at 00:27 UTC
a54fcf1665c63eaaadf4107ade9fe1c93e15bcf1
1 file changed
+76
-76
meshuser.js
+76
-76
@@ -994,81 +994,6 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
994
});
995
break;
996
}
997
- case 'changeemail':
998
- {
999
- // Do not allow this command when logged in using a login token
1000
- if (req.session.loginToken != null) break;
1001
-
1002
- // If the email is the username, this command is not allowed.
1003
- if (domain.usernameisemail) return;
1004
-
1005
- // If this account is settings locked, return here.
1006
- if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
1007
-
1008
- // Change our own email address
1009
- if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
1010
- if (common.validateEmail(command.email, 1, 1024) == false) return;
1011
-
1012
- // Always lowercase the email address
1013
- command.email = command.email.toLowerCase();
1014
-
1015
- if (obj.user.email != command.email) {
1016
- // Check if this email is already validated on a different account
1017
- db.GetUserWithVerifiedEmail(domain.id, command.email, function (err, docs) {
1018
- if ((docs != null) && (docs.length > 0)) {
1019
- // Notify the duplicate email error
1020
- try { ws.send(JSON.stringify({ action: 'msg', type: 'notify', title: 'Account Settings', id: Math.random(), tag: 'ServerNotify', value: 'Failed to change email address, another account already using: ' + command.email + '.', titleid: 4, msgid: 13, args: [command.email] })); } catch (ex) { }
1021
- } else {
1022
- // Update the user's email
1023
- var oldemail = user.email;
1024
- user.email = command.email;
1025
- user.emailVerified = false;
1026
- parent.db.SetUser(user);
1027
-
1028
- // Event the change
1029
- var message = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', domain: domain.id };
1030
- if (db.changeStream) { message.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
1031
- if (oldemail != null) {
1032
- message.msg = 'Changed email of user ' + user.name + ' from ' + oldemail + ' to ' + user.email;
1033
- } else {
1034
- message.msg = 'Set email of user ' + user.name + ' to ' + user.email;
1035
- }
1036
-
1037
- var targets = ['*', 'server-users', user._id];
1038
- if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
1039
- parent.parent.DispatchEvent(targets, obj, message);
1040
-
1041
- // Log in the auth log
1042
- if (parent.parent.authlog) { parent.parent.authLog('https', 'User ' + user.name + ' changed email from ' + oldemail + ' to ' + user.email); }
1043
-
1044
- // Send the verification email
1045
- if (domain.mailserver != null) { domain.mailserver.sendAccountCheckMail(domain, user.name, user._id, user.email, parent.getLanguageCodes(req)); }
1046
- }
1047
- });
1048
- }
1049
- break;
1050
- }
1051
- case 'verifyemail':
1052
- {
1053
- // Do not allow this command when logged in using a login token
1054
- if (req.session.loginToken != null) break;
1055
-
1056
- // If this account is settings locked, return here.
1057
- if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
1058
-
1059
- // Send a account email verification email
1060
- if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
1061
- if (common.validateString(command.email, 3, 1024) == false) return;
1062
-
1063
- // Always lowercase the email address
1064
- command.email = command.email.toLowerCase();
1065
-
1066
- if ((domain.mailserver != null) && (obj.user.email.toLowerCase() == command.email)) {
1067
- // Send the verification email
1068
- domain.mailserver.sendAccountCheckMail(domain, user.name, user._id, user.email, parent.getLanguageCodes(req));
1069
- }
1070
- break;
1071
- }
997
case 'wssessioncount':
998
{
999
// Request a list of all web socket user session count
@@ -5378,6 +5303,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5303
'adduserbatch': serverCommandAddUserBatch,
5304
'addusertousergroup': serverCommandAddUserToUserGroup,
5305
'authcookie': serverCommandAuthCookie,
5306
+ 'changeemail': serverCommandChangeEmail,
5307
'changelang': serverCommandChangeLang,
5308
'files': serverCommandFiles,
5309
'getnetworkinfo': serverCommandGetNetworkInfo,
@@ -5401,7 +5327,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5327
'serverupdate': serverCommandServerUpdate,
5328
'serverversion': serverCommandServerVersion,
5329
'urlargs': serverCommandUrlArgs,
5404
- 'users': serverCommandUsers
5330
+ 'users': serverCommandUsers,
5331
+ 'verifyemail': serverCommandVerifyEmail
5332
};
5333
5334
const serverUserCommands = {
@@ -5756,6 +5683,59 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5683
} catch (ex) { }
5684
}
5685
5686
+ function serverCommandChangeEmail(command) {
5687
+ // Do not allow this command when logged in using a login token
5688
+ if (req.session.loginToken != null) return;
5689
+
5690
+ // If the email is the username, this command is not allowed.
5691
+ if (domain.usernameisemail) return;
5692
+
5693
+ // If this account is settings locked, return here.
5694
+ if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
5695
+
5696
+ // Change our own email address
5697
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
5698
+ if (common.validateEmail(command.email, 1, 1024) == false) return;
5699
+
5700
+ // Always lowercase the email address
5701
+ command.email = command.email.toLowerCase();
5702
+
5703
+ if (obj.user.email != command.email) {
5704
+ // Check if this email is already validated on a different account
5705
+ db.GetUserWithVerifiedEmail(domain.id, command.email, function (err, docs) {
5706
+ if ((docs != null) && (docs.length > 0)) {
5707
+ // Notify the duplicate email error
5708
+ try { ws.send(JSON.stringify({ action: 'msg', type: 'notify', title: 'Account Settings', id: Math.random(), tag: 'ServerNotify', value: 'Failed to change email address, another account already using: ' + command.email + '.', titleid: 4, msgid: 13, args: [command.email] })); } catch (ex) { }
5709
+ } else {
5710
+ // Update the user's email
5711
+ var oldemail = user.email;
5712
+ user.email = command.email;
5713
+ user.emailVerified = false;
5714
+ parent.db.SetUser(user);
5715
+
5716
+ // Event the change
5717
+ var message = { etype: 'user', userid: user._id, username: user.name, account: parent.CloneSafeUser(user), action: 'accountchange', domain: domain.id };
5718
+ if (db.changeStream) { message.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
5719
+ if (oldemail != null) {
5720
+ message.msg = 'Changed email of user ' + user.name + ' from ' + oldemail + ' to ' + user.email;
5721
+ } else {
5722
+ message.msg = 'Set email of user ' + user.name + ' to ' + user.email;
5723
+ }
5724
+
5725
+ var targets = ['*', 'server-users', user._id];
5726
+ if (user.groups) { for (var i in user.groups) { targets.push('server-users:' + i); } }
5727
+ parent.parent.DispatchEvent(targets, obj, message);
5728
+
5729
+ // Log in the auth log
5730
+ if (parent.parent.authlog) { parent.parent.authLog('https', 'User ' + user.name + ' changed email from ' + oldemail + ' to ' + user.email); }
5731
+
5732
+ // Send the verification email
5733
+ if (domain.mailserver != null) { domain.mailserver.sendAccountCheckMail(domain, user.name, user._id, user.email, parent.getLanguageCodes(req)); }
5734
+ }
5735
+ });
5736
+ }
5737
+ }
5738
+
5739
function serverCommandChangeLang(command) {
5740
// Do not allow this command when logged in using a login token
5741
if (req.session.loginToken != null) return;
@@ -6124,6 +6104,26 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
6104
try { ws.send(JSON.stringify({ action: 'users', users: docs, tag: command.tag })); } catch (ex) { }
6105
}
6106
6107
+ function serverCommandVerifyEmail(command) {
6108
+ // Do not allow this command when logged in using a login token
6109
+ if (req.session.loginToken != null) return;
6110
+
6111
+ // If this account is settings locked, return here.
6112
+ if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return;
6113
+
6114
+ // Send a account email verification email
6115
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) return;
6116
+ if (common.validateString(command.email, 3, 1024) == false) return;
6117
+
6118
+ // Always lowercase the email address
6119
+ command.email = command.email.toLowerCase();
6120
+
6121
+ if ((domain.mailserver != null) && (obj.user.email.toLowerCase() == command.email)) {
6122
+ // Send the verification email
6123
+ domain.mailserver.sendAccountCheckMail(domain, user.name, user._id, user.email, parent.getLanguageCodes(req));
6124
+ }
6125
+ }
6126
+
6127
6128
function serverUserCommandHelp(cmdData) {
6129
var fin = '', f = '', availcommands = [];