Fix for #2773.
Ylian Saint-Hilaire committed
Jun 14, 2021 at 14:36 UTC
b926196d0a06f7629637c53ba33d6ac09b7f7b9c
2 files changed
+27
-39
package.json
+1
-13
@@ -36,8 +36,6 @@
36
"sample-config-advanced.json"
37
],
38
"dependencies": {
39
- "archiver": "^4.0.2",
40
- "archiver-zip-encrypted": "^1.0.10",
39
"body-parser": "^1.19.0",
40
"cbor": "~5.2.0",
41
"compression": "^1.7.4",
@@ -45,24 +43,14 @@
43
"express": "^4.17.0",
44
"express-handlebars": "^3.1.0",
45
"express-ws": "^4.0.0",
48
- "image-size": "^1.0.0",
46
"ipcheck": "^0.1.0",
50
- "loadavg-windows": "^1.1.1",
47
"minimist": "^1.2.0",
52
- "mongodb": "^3.6.9",
48
"multiparty": "^4.2.1",
49
"nedb": "^1.8.0",
50
"node-forge": "^0.10.0",
56
- "node-rdpjs-2": "^0.3.5",
57
- "node-windows": "^1.0.0-beta.5",
58
- "otplib": "^10.2.3",
59
- "saslprep": "^1.0.3",
60
- "ssh2": "^1.1.0",
61
- "web-push": "^3.4.4",
51
"ws": "^5.2.0",
52
"xmldom": "^0.5.0",
64
- "yauzl": "^2.10.0",
65
- "yubikeyotp": "^0.2.0"
53
+ "yauzl": "^2.10.0"
54
},
55
"repository": {
56
"type": "git",
webserver.js
+26
-26
@@ -408,7 +408,32 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
408
// Authenticate the user
409
obj.authenticate = function (name, pass, domain, fn) {
410
if ((typeof (name) != 'string') || (typeof (pass) != 'string') || (typeof (domain) != 'object')) { fn(new Error('invalid fields')); return; }
411
- if (domain.auth == 'ldap') {
411
+ if (name.startsWith('~t:')) {
412
+ // Login token, try to fetch the token from the database
413
+ obj.db.Get('logintoken-' + name, function (err, docs) {
414
+ if (err != null) { fn(err); return; }
415
+ if ((docs == null) || (docs.length != 1)) { fn(new Error('login token not found')); return; }
416
+ const loginToken = docs[0];
417
+ if ((loginToken.expire != 0) && (loginToken.expire < Date.now())) { fn(new Error('login token expired')); return; }
418
+
419
+ // Default strong password hashing (pbkdf2 SHA384)
420
+ require('./pass').hash(pass, loginToken.salt, function (err, hash, tag) {
421
+ if (err) return fn(err);
422
+ if (hash == loginToken.hash) {
423
+ // Login username and password are valid.
424
+ var user = obj.users[loginToken.userid];
425
+ if (!user) { fn(new Error('cannot find user')); return; }
426
+ if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
427
+
428
+ // Succesful login token authentication
429
+ var loginOptions = { tokenName: loginToken.name, tokenUser: loginToken.tokenUser };
430
+ if (loginToken.expire != 0) { loginOptions.expire = loginToken.expire; }
431
+ return fn(null, user._id, null, loginOptions);
432
+ }
433
+ fn(new Error('invalid password'));
434
+ }, 0);
435
+ });
436
+ } else if (domain.auth == 'ldap') {
437
if (domain.ldapoptions.url == 'test') {
438
// Fake LDAP login
439
var xxuser = domain.ldapoptions[name.toLowerCase()];
@@ -633,31 +658,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
658
}
659
});
660
}
636
- } else if (name.startsWith('~t:')) {
637
- // Login token, try to fetch the token from the database
638
- obj.db.Get('logintoken-' + name, function (err, docs) {
639
- if (err != null) { fn(err); return; }
640
- if ((docs == null) || (docs.length != 1)) { fn(new Error('login token not found')); return; }
641
- const loginToken = docs[0];
642
- if ((loginToken.expire != 0) && (loginToken.expire < Date.now())) { fn(new Error('login token expired')); return; }
643
-
644
- // Default strong password hashing (pbkdf2 SHA384)
645
- require('./pass').hash(pass, loginToken.salt, function (err, hash, tag) {
646
- if (err) return fn(err);
647
- if (hash == loginToken.hash) {
648
- // Login username and password are valid.
649
- var user = obj.users[loginToken.userid];
650
- if (!user) { fn(new Error('cannot find user')); return; }
651
- if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
652
-
653
- // Succesful login token authentication
654
- var loginOptions = { tokenName: loginToken.name, tokenUser: loginToken.tokenUser };
655
- if (loginToken.expire != 0) { loginOptions.expire = loginToken.expire; }
656
- return fn(null, user._id, null, loginOptions);
657
- }
658
- fn(new Error('invalid password'));
659
- }, 0);
660
- });
661
} else {
662
// Regular login
663
var user = obj.users['user/' + domain.id + '/' + name.toLowerCase()];