Additional login token checking.
Ylian Saint-Hilaire committed
Apr 16, 2021 at 23:15 UTC
bb1b3787ecc790c68877d8f7389e05f9ec061fef
1 file changed
+6
webserver.js
+6
@@ -2377,6 +2377,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2377
req.session.ip = req.clientIp; // Bind this session to the IP address of the request
2378
handleRootRequestEx(req, res, domain, direct);
2379
});
2380
+ } else if ((req.session != null) && (typeof req.session.loginToken == 'string')) {
2381
+ // Check if the loginToken is still valid
2382
+ obj.db.Get('logintoken-' + req.session.loginToken, function (err, docs) {
2383
+ if ((err != null) || (docs == null) || (docs.length != 1) || (docs[0].tokenUser != req.session.loginToken)) { for (var i in req.session) { delete req.session[i]; } }
2384
+ handleRootRequestEx(req, res, domain, direct); // Login using a different system
2385
+ });
2386
} else {
2387
// Login using a different system
2388
handleRootRequestEx(req, res, domain, direct);