Fixed user and agent IP address filtering.
Ylian Saint-Hilaire committed
Mar 26, 2020 at 12:06 UTC
b07a8bf3c5188cf587c92f8de353fa9f6475c1b4
2 files changed
+65
-41
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.5.0-t",
3
+ "version": "0.5.0-u",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+64
-40
@@ -476,19 +476,22 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
476
}
477
478
// Check if the source IP address is allowed, return domain if allowed
479
+ // If there is a fail and null is returned, the request or connection is closed already.
480
function checkUserIpAddress(req, res) {
481
if ((parent.config.settings.userblockedip != null) && (checkIpAddressEx(req, res, parent.config.settings.userblockedip, true) == true)) { obj.blockedUsers++; return null; }
482
if ((parent.config.settings.userallowedip != null) && (checkIpAddressEx(req, res, parent.config.settings.userallowedip, false) == false)) { obj.blockedUsers++; return null; }
483
const domain = (req.url ? getDomain(req) : getDomain(res));
484
+ if (domain == null) { parent.debug('web', 'handleRootRequest: invalid domain.'); try { res.sendStatus(404); } catch (ex) { } return; }
485
if ((domain.userblockedip != null) && (checkIpAddressEx(req, res, domain.userblockedip, true) == true)) { obj.blockedUsers++; return null; }
486
if ((domain.userallowedip != null) && (checkIpAddressEx(req, res, domain.userallowedip, false) == false)) { obj.blockedUsers++; return null; }
487
return domain;
488
}
489
490
// Check if the source IP address is allowed, return domain if allowed
491
+ // If there is a fail and null is returned, the request or connection is closed already.
492
function checkAgentIpAddress(req, res) {
490
- if ((parent.config.settings.agentblockedip != null) && (checkIpAddressEx(req, res, parent.config.settings.agentblockedip, true) == true)) { obj.blockedAgents++; return null; }
491
- if ((parent.config.settings.agentallowedip != null) && (checkIpAddressEx(req, res, parent.config.settings.agentallowedip, false) == false)) { obj.blockedAgents++; return null; }
493
+ if ((parent.config.settings.agentblockedip != null) && (checkIpAddressEx(req, res, parent.config.settings.agentblockedip, null) == true)) { obj.blockedAgents++; return null; }
494
+ if ((parent.config.settings.agentallowedip != null) && (checkIpAddressEx(req, res, parent.config.settings.agentallowedip, null) == false)) { obj.blockedAgents++; return null; }
495
const domain = (req.url ? getDomain(req) : getDomain(res));
496
if ((domain.agentblockedip != null) && (checkIpAddressEx(req, res, domain.agentblockedip, null) == true)) { obj.blockedAgents++; return null; }
497
if ((domain.agentallowedip != null) && (checkIpAddressEx(req, res, domain.agentallowedip, null) == false)) { obj.blockedAgents++; return null; }
@@ -496,6 +499,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
499
}
500
501
// Return the current domain of the request
502
+ // Request or connection says open regardless of the response
503
function getDomain(req) {
504
if (req.xdomain != null) { return req.xdomain; } // Domain already set for this request, return it.
505
if (req.headers.host != null) { var d = obj.dnsDomains[req.headers.host.split(':')[0].toLowerCase()]; if (d != null) return d; } // If this is a DNS name domain, return it here.
@@ -508,7 +512,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
512
513
function handleLogoutRequest(req, res) {
514
const domain = checkUserIpAddress(req, res);
511
- if ((domain == null) || (domain.auth == 'sspi')) { parent.debug('web', 'handleLogoutRequest: failed checks.'); res.sendStatus(404); return; }
515
+ if (domain == null) { return; }
516
+ if (domain.auth == 'sspi') { parent.debug('web', 'handleLogoutRequest: failed checks.'); res.sendStatus(404); return; }
517
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
518
519
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
@@ -696,7 +701,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
701
702
function handleLoginRequest(req, res, direct) {
703
const domain = checkUserIpAddress(req, res);
699
- if (domain == null) { parent.debug('web', 'handleLoginRequest: invalid domain'); res.sendStatus(404); return; }
704
+ if (domain == null) { return; }
705
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
706
707
// Check if this is a banned ip address
@@ -875,7 +880,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
880
881
function handleCreateAccountRequest(req, res, direct) {
882
const domain = checkUserIpAddress(req, res);
878
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleCreateAccountRequest: failed checks.'); res.sendStatus(404); return; }
883
+ if (domain == null) { return; }
884
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleCreateAccountRequest: failed checks.'); res.sendStatus(404); return; }
885
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
886
887
// Always lowercase the email address
@@ -987,6 +993,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
993
// Called to process an account password reset
994
function handleResetPasswordRequest(req, res, direct) {
995
const domain = checkUserIpAddress(req, res);
996
+ if (domain == null) { return; }
997
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
998
999
// Check everything is ok
@@ -1071,7 +1078,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1078
// Called to process an account reset request
1079
function handleResetAccountRequest(req, res, direct) {
1080
const domain = checkUserIpAddress(req, res);
1074
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (obj.args.lanonly == true) || (obj.parent.certificates.CommonName == null) || (obj.parent.certificates.CommonName.indexOf('.') == -1)) { parent.debug('web', 'handleResetAccountRequest: check failed'); res.sendStatus(404); return; }
1081
+ if (domain == null) { return; }
1082
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap') || (obj.args.lanonly == true) || (obj.parent.certificates.CommonName == null) || (obj.parent.certificates.CommonName.indexOf('.') == -1)) { parent.debug('web', 'handleResetAccountRequest: check failed'); res.sendStatus(404); return; }
1083
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1084
1085
// Always lowercase the email address
@@ -1164,7 +1172,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1172
// Called to process a web based email verification request
1173
function handleCheckMailRequest(req, res) {
1174
const domain = checkUserIpAddress(req, res);
1167
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleCheckMailRequest: failed checks.'); res.sendStatus(404); return; }
1175
+ if (domain == null) { return; }
1176
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleCheckMailRequest: failed checks.'); res.sendStatus(404); return; }
1177
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1178
1179
if (req.query.c != null) {
@@ -1313,7 +1322,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1322
function handleDeleteAccountRequest(req, res, direct) {
1323
parent.debug('web', 'handleDeleteAccountRequest()');
1324
const domain = checkUserIpAddress(req, res);
1316
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleDeleteAccountRequest: failed checks.'); res.sendStatus(404); return; }
1325
+ if (domain == null) { return; }
1326
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handleDeleteAccountRequest: failed checks.'); res.sendStatus(404); return; }
1327
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1328
1329
var user = null;
@@ -1400,7 +1410,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1410
// Handle password changes
1411
function handlePasswordChangeRequest(req, res, direct) {
1412
const domain = checkUserIpAddress(req, res);
1403
- if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handlePasswordChangeRequest: failed checks (1).'); res.sendStatus(404); return; }
1413
+ if (domain == null) { return; }
1414
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { parent.debug('web', 'handlePasswordChangeRequest: failed checks (1).'); res.sendStatus(404); return; }
1415
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1416
1417
// Check if the user is logged and we have all required parameters
@@ -1441,7 +1452,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1452
// Indicates that any request to "/" should render "default" or "login" depending on login state
1453
function handleRootRequest(req, res, direct) {
1454
const domain = checkUserIpAddress(req, res);
1444
- if (domain == null) { parent.debug('web', 'handleRootRequest: invalid domain.'); try { res.sendStatus(404); } catch (ex) { } return; }
1455
+ if (domain == null) { return; }
1456
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1457
if (!obj.args) { parent.debug('web', 'handleRootRequest: no obj.args.'); res.sendStatus(500); return; }
1458
@@ -1751,7 +1762,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1762
// Handle a post request on the root
1763
function handleRootPostRequest(req, res) {
1764
const domain = checkUserIpAddress(req, res);
1754
- if (domain == null) { parent.debug('web', 'handleTermsRequest: Bad domain'); res.end("Not Found"); return; }
1765
+ if (domain == null) { return; }
1766
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.end("Not Found"); return; } // Check 3FA URL key
1767
parent.debug('web', 'handleRootPostRequest, action: ' + req.body.action);
1768
@@ -1795,7 +1806,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1806
// Serve the xterm page
1807
function handleXTermRequest(req, res) {
1808
const domain = checkUserIpAddress(req, res);
1798
- if (domain == null) { parent.debug('web', 'handleXTermRequest: Bad domain'); res.sendStatus(404); return; }
1809
+ if (domain == null) { return; }
1810
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1811
1812
parent.debug('web', 'handleXTermRequest: sending xterm');
@@ -1828,7 +1839,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1839
// Render the terms of service.
1840
function handleTermsRequest(req, res) {
1841
const domain = checkUserIpAddress(req, res);
1831
- if (domain == null) { parent.debug('web', 'handleTermsRequest: Bad domain'); res.sendStatus(404); return; }
1842
+ if (domain == null) { return; }
1843
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1844
1845
// See if term.txt was loaded from the database
@@ -2032,7 +2043,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2043
// Handle user public file downloads
2044
function handleDownloadUserFiles(req, res) {
2045
const domain = checkUserIpAddress(req, res);
2035
- if (domain == null) { res.sendStatus(404); return; }
2046
+ if (domain == null) { return; }
2047
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
2048
2049
if (obj.common.validateString(req.path, 1, 4096) == false) { res.sendStatus(404); return; }
@@ -2063,9 +2074,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2074
// Handle logo request
2075
function handleLogoRequest(req, res) {
2076
const domain = checkUserIpAddress(req, res);
2077
+ if (domain == null) { return; }
2078
2079
//res.set({ 'Cache-Control': 'max-age=86400' }); // 1 day
2068
- if ((domain != null) && domain.titlepicture) {
2080
+ if (domain.titlepicture) {
2081
if ((parent.configurationFiles != null) && (parent.configurationFiles[domain.titlepicture] != null)) {
2082
// Use the logo in the database
2083
res.set({ 'Content-Type': 'image/jpeg' });
@@ -2077,7 +2089,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2089
}
2090
}
2091
2080
- if ((domain != null) && (domain.webpublicpath != null) && (obj.fs.existsSync(obj.path.join(domain.webpublicpath, 'images/logoback.png')))) {
2092
+ if ((domain.webpublicpath != null) && (obj.fs.existsSync(obj.path.join(domain.webpublicpath, 'images/logoback.png')))) {
2093
// Use the domain logo picture
2094
try { res.sendFile(obj.path.join(domain.webpublicpath, 'images/logoback.png')); } catch (ex) { res.sendStatus(404); }
2095
} else if (parent.webPublicOverridePath && obj.fs.existsSync(obj.path.join(obj.parent.webPublicOverridePath, 'images/logoback.png'))) {
@@ -2092,6 +2104,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2104
// Handle translation request
2105
function handleTranslationsRequest(req, res) {
2106
const domain = checkUserIpAddress(req, res);
2107
+ if (domain == null) { return; }
2108
//if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
2109
if ((obj.userAllowedIp != null) && (checkIpAddressEx(req, res, obj.userAllowedIp, false) === false)) { return; } // Check server-wide IP filter only.
2110
@@ -2155,9 +2168,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2168
// Handle welcome image request
2169
function handleWelcomeImageRequest(req, res) {
2170
const domain = checkUserIpAddress(req, res);
2171
+ if (domain == null) { return; }
2172
2173
//res.set({ 'Cache-Control': 'max-age=86400' }); // 1 day
2160
- if ((domain != null) && domain.welcomepicture) {
2174
+ if (domain.welcomepicture) {
2175
if ((parent.configurationFiles != null) && (parent.configurationFiles[domain.welcomepicture] != null)) {
2176
// Use the welcome image in the database
2177
res.set({ 'Content-Type': 'image/jpeg' });
@@ -2169,7 +2183,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2183
try { res.sendFile(obj.path.join(obj.parent.datapath, domain.welcomepicture)); return; } catch (ex) { }
2184
}
2185
2172
- if ((domain != null) && (domain.webpublicpath != null)) {
2186
+ if (domain.webpublicpath != null) {
2187
obj.fs.exists(obj.path.join(domain.webpublicpath, 'images/mainwelcome.jpg'), function (exists) {
2188
if (exists) {
2189
// Use the domain logo picture
@@ -2198,7 +2212,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2212
// Server the player page
2213
function handlePlayerRequest(req, res) {
2214
const domain = checkUserIpAddress(req, res);
2201
- if (domain == null) { res.sendStatus(404); return; }
2215
+ if (domain == null) { return; }
2216
2217
parent.debug('web', 'handlePlayerRequest: sending player');
2218
res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
@@ -2208,7 +2222,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2222
// Handle domain redirection
2223
obj.handleDomainRedirect = function (req, res) {
2224
const domain = checkUserIpAddress(req, res);
2211
- if ((domain == null) || (domain.redirects == null)) { res.sendStatus(404); return; }
2225
+ if (domain == null) { return; }
2226
+ if (domain.redirects == null) { res.sendStatus(404); return; }
2227
var urlArgs = '', urlName = null, splitUrl = req.originalUrl.split('?');
2228
if (splitUrl.length > 1) { urlArgs = '?' + splitUrl[1]; }
2229
if ((splitUrl.length > 0) && (splitUrl[0].length > 1)) { urlName = splitUrl[0].substring(1).toLowerCase(); }
@@ -2258,7 +2273,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2273
// Download a file from the server
2274
function handleDownloadFile(req, res) {
2275
const domain = checkUserIpAddress(req, res);
2261
- if (domain == null) { res.sendStatus(404); return; }
2276
+ if (domain == null) { return; }
2277
if ((req.query.link == null) || (req.session == null) || (req.session.userid == null) || (domain == null) || (domain.userQuota == -1)) { res.sendStatus(404); return; }
2278
const user = obj.users[req.session.userid];
2279
if (user == null) { res.sendStatus(404); return; }
@@ -2275,7 +2290,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2290
// Upload a MeshCore.js file to the server
2291
function handleUploadMeshCoreFile(req, res) {
2292
const domain = checkUserIpAddress(req, res);
2278
- if (domain == null) { res.sendStatus(404); return; }
2293
+ if (domain == null) { return; }
2294
if (domain.id !== '') { res.sendStatus(401); return; }
2295
2296
var authUserid = null;
@@ -2313,7 +2328,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2328
// Upload a file to the server
2329
function handleUploadFile(req, res) {
2330
const domain = checkUserIpAddress(req, res);
2316
- if (domain == null) { res.sendStatus(404); return; }
2331
+ if (domain == null) { return; }
2332
if (domain.userQuota == -1) { res.sendStatus(401); return; }
2333
var authUserid = null;
2334
if ((req.session != null) && (typeof req.session.userid == 'string')) { authUserid = req.session.userid; }
@@ -2771,7 +2786,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2786
// Handle a Intel AMT activation request
2787
function handleAmtActivateWebSocket(ws, req) {
2788
const domain = checkUserIpAddress(ws, req);
2774
- if (domain == null) { ws.send(JSON.stringify({ errorText: 'Invalid domain' })); ws.close(); return; }
2789
+ if (domain == null) { return; }
2790
if (req.query.id == null) { ws.send(JSON.stringify({ errorText: 'Missing group identifier' })); ws.close(); return; }
2791
2792
// Fetch the mesh object
@@ -2960,7 +2975,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2975
// Handle the web socket echo request, just echo back the data sent
2976
function handleEchoWebSocket(ws, req) {
2977
const domain = checkUserIpAddress(ws, req);
2963
- if (domain == null) { res.sendStatus(404); return; }
2978
+ if (domain == null) { return; }
2979
ws._socket.setKeepAlive(true, 240000); // Set TCP keep alive
2980
2981
// When data is received from the web socket, echo it back
@@ -3089,7 +3104,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3104
// Handle a server backup request
3105
function handleBackupRequest(req, res) {
3106
const domain = checkUserIpAddress(req, res);
3092
- if (domain == null) { res.sendStatus(404); return; }
3107
+ if (domain == null) { return; }
3108
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
3109
if ((!req.session) || (req.session == null) || (!req.session.userid) || (obj.parent.args.noserverbackup == 1)) { res.sendStatus(401); return; }
3110
var user = obj.users[req.session.userid];
@@ -3122,7 +3137,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3137
// Handle a server restore request
3138
function handleRestoreRequest(req, res) {
3139
const domain = checkUserIpAddress(req, res);
3125
- if (domain == null) { res.sendStatus(404); return; }
3140
+ if (domain == null) { return; }
3141
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
3142
if (obj.parent.args.noserverbackup == 1) { res.sendStatus(401); return; }
3143
var authUserid = null;
@@ -3149,8 +3164,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3164
3165
// Handle a request to download a mesh agent
3166
obj.handleMeshAgentRequest = function (req, res) {
3152
- const domain = checkUserIpAddress(req, res);
3153
- if (domain == null) { res.sendStatus(404); return; }
3167
+ const domain = getDomain(req, res);
3168
+ if (domain == null) { parent.debug('web', 'handleRootRequest: invalid domain.'); try { res.sendStatus(404); } catch (ex) { } return; }
3169
3170
// If required, check if this user has rights to do this
3171
if ((obj.parent.config.settings != null) && ((obj.parent.config.settings.lockagentdownload == true) || (domain.lockagentdownload == true)) && (req.session.userid == null)) { res.sendStatus(401); return; }
@@ -3300,6 +3315,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3315
res.sendStatus(401);
3316
}
3317
} else {
3318
+ domain = checkUserIpAddress(req, res); // Recheck the domain to apply user IP filtering.
3319
+ if (domain == null) return;
3320
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
3321
// Send a list of available mesh agents
3322
var response = '<html><head><title>Mesh Agents</title><style>table,th,td { border:1px solid black;border-collapse:collapse;padding:3px; }</style></head><body><table>';
@@ -3325,8 +3342,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3342
3343
// Create a OSX mesh agent installer
3344
obj.handleMeshOsxAgentRequest = function (req, res) {
3328
- const domain = checkUserIpAddress(req, res);
3329
- if ((domain == null) || (req.query.id == null)) { res.sendStatus(404); return; }
3345
+ const domain = getDomain(req, res);
3346
+ if (domain == null) { parent.debug('web', 'handleRootRequest: invalid domain.'); try { res.sendStatus(404); } catch (ex) { } return; }
3347
+ if (req.query.id == null) { res.sendStatus(404); return; }
3348
3349
// If required, check if this user has rights to do this
3350
if ((obj.parent.config.settings != null) && ((obj.parent.config.settings.lockagentdownload == true) || (domain.lockagentdownload == true)) && (req.session.userid == null)) { res.sendStatus(401); return; }
@@ -3417,7 +3435,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3435
// Handle a request to download a mesh settings
3436
obj.handleMeshSettingsRequest = function (req, res) {
3437
const domain = checkUserIpAddress(req, res);
3420
- if (domain == null) { res.sendStatus(404); return; }
3438
+ if (domain == null) { return; }
3439
//if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
3440
3441
// If required, check if this user has rights to do this
@@ -3454,7 +3472,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3472
// Handle a request for power events
3473
obj.handleDevicePowerEvents = function (req, res) {
3474
const domain = checkUserIpAddress(req, res);
3457
- if (domain == null) { res.sendStatus(404); return; }
3475
+ if (domain == null) { return; }
3476
if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (req.query.id == null) || (typeof req.query.id != 'string')) { res.sendStatus(401); return; }
3477
var x = req.query.id.split('/');
3478
var user = obj.users[req.session.userid];
@@ -3493,7 +3511,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3511
// Handle a plugin admin request
3512
obj.handlePluginAdminReq = function (req, res) {
3513
const domain = checkUserIpAddress(req, res);
3496
- if (domain == null) { res.sendStatus(404); return; }
3514
+ if (domain == null) { return; }
3515
if ((!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
3516
var user = obj.users[req.session.userid];
3517
if (user == null) { res.sendStatus(401); return; }
@@ -3503,7 +3521,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3521
3522
obj.handlePluginAdminPostReq = function (req, res) {
3523
const domain = checkUserIpAddress(req, res);
3506
- if (domain == null) { res.sendStatus(404); return; }
3524
+ if (domain == null) { return; }
3525
if ((!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
3526
var user = obj.users[req.session.userid];
3527
if (user == null) { res.sendStatus(401); return; }
@@ -3513,7 +3531,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3531
3532
obj.handlePluginJS = function (req, res) {
3533
const domain = checkUserIpAddress(req, res);
3516
- if (domain == null) { res.sendStatus(404); return; }
3534
+ if (domain == null) { return; }
3535
if ((!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
3536
var user = obj.users[req.session.userid];
3537
if (user == null) { res.sendStatus(401); return; }
@@ -3694,7 +3712,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3712
// Receive mesh agent connections
3713
obj.app.ws(url + 'agent.ashx', function (ws, req) {
3714
var domain = checkAgentIpAddress(ws, req);
3697
- if (domain == null) { parent.debug('web', 'Got agent connection from blocked IP address ' + cleanRemoteAddr(req.ip) + ', holding.'); return; }
3715
+ if (domain == null) { parent.debug('web', 'Got agent connection with bad domain or blocked IP address ' + cleanRemoteAddr(req.ip) + ', holding.'); return; }
3716
//console.log('Agent connect: ' + cleanRemoteAddr(req.ip));
3717
try { obj.meshAgentHandler.CreateMeshAgent(obj, obj.db, ws, req, obj.args, domain); } catch (e) { console.log(e); }
3718
});
@@ -3703,7 +3721,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3721
if (obj.parent.mqttbroker != null) {
3722
obj.app.ws(url + 'mqtt.ashx', function (ws, req) {
3723
var domain = checkAgentIpAddress(ws, req);
3706
- if (domain == null) { parent.debug('web', 'Got agent connection from blocked IP address ' + cleanRemoteAddr(req.ip) + ', holding.'); return; }
3724
+ if (domain == null) { parent.debug('web', 'Got agent connection with bad domain or blocked IP address ' + cleanRemoteAddr(req.ip) + ', holding.'); return; }
3725
var serialtunnel = SerialTunnel();
3726
serialtunnel.xtransport = 'ws';
3727
serialtunnel.xdomain = domain;
@@ -3789,8 +3807,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3807
3808
// Check IP filtering and domain
3809
var domain = null;
3792
- if (noAuthOk == true) { domain = getDomain(req); } else { domain = checkUserIpAddress(ws, req); } // If auth is required, enforce IP address filtering.
3793
- if (domain == null) { try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'noauth-1' })); ws.close(); return; } catch (e) { return; } }
3810
+ if (noAuthOk == true) {
3811
+ domain = getDomain(req);
3812
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'noauth-1' })); ws.close(); return; } catch (e) { return; }
3813
+ } else {
3814
+ // If authentication is required, enforce IP address filtering.
3815
+ domain = checkUserIpAddress(ws, req);
3816
+ if (domain == null) { return; }
3817
+ }
3818
3819
// A web socket session can be authenticated in many ways (Default user, session, user/pass and cookie). Check authentication here.
3820
if ((req.query.user != null) && (req.query.pass != null)) {