Validate user email domain when adding a new user
Tung Hoang committed
Mar 15, 2022 at 22:11 UTC
bf113954a5ae534bca850eadeca4edff90018044
4 files changed
+28
-4
common.js
+21
@@ -171,7 +171,28 @@ module.exports.validateEmail = function (email, minlen, maxlen) { if (module.exp
171
module.exports.validateUsername = function (username, minlen, maxlen) { return (module.exports.validateString(username, minlen, maxlen) && (username.indexOf(' ') == -1) && (username.indexOf('"') == -1) && (username.indexOf(',') == -1)); };
172
module.exports.isAlphaNumeric = function (str) { return (str.match(/^[A-Za-z0-9]+$/) != null); };
173
module.exports.validateAlphaNumericArray = function (array, minlen, maxlen) { if (((array != null) && Array.isArray(array)) == false) return false; for (var i in array) { if ((typeof array[i] != 'string') || (module.exports.isAlphaNumeric(array[i]) == false) || ((minlen != null) && (array[i].length < minlen)) || ((maxlen != null) && (array[i].length > maxlen)) ) return false; } return true; };
174
+module.exports.getEmailDomain = function(email) {
175
+ if (!module.exports.validateEmail(email, 1, 1024)) {
176
+ return '';
177
+ }
178
+ const i = email.indexOf('@');
179
+ return email.substring(i + 1).toLowerCase();
180
+}
181
182
+module.exports.validateEmailDomain = function(email, allowedDomains) {
183
+ // Check if this request is for an allows email domain
184
+ if ((allowedDomains != null) && Array.isArray(allowedDomains)) {
185
+ const emaildomain = module.exports.getEmailDomain(email);
186
+ if (emaildomain === '') {
187
+ return false;
188
+ }
189
+ var emailok = false;
190
+ for (var i in allowedDomains) { if (emaildomain == allowedDomains[i].toLowerCase()) { emailok = true; } }
191
+ return emailok;
192
+ }
193
+
194
+ return true;
195
+}
196
// Check password requirements
197
module.exports.checkPasswordRequirements = function(password, requirements) {
198
if ((requirements == null) || (requirements == '') || (typeof requirements != 'object')) return true;
meshuser.js
+3
-2
@@ -5186,7 +5186,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5186
if (command.randomPassword === true) { command.pass = getRandomPassword(); }
5187
5188
// Add a new user account
5189
- var err = null, errid = 0, newusername, newuserid, newuserdomain;
5189
+ var err = null, errid = 0, args = null, newusername, newuserid, newuserdomain;
5190
try {
5191
if ((user.siteadmin & MESHRIGHT_MANAGEUSERS) == 0) { err = "Permission denied"; errid = 1; }
5192
else if (common.validateUsername(command.username, 1, 256) == false) { err = "Invalid username"; errid = 2; } // Username is between 1 and 64 characters, no spaces
@@ -5195,6 +5195,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5195
else if ((command.randomPassword !== true) && (common.checkPasswordRequirements(command.pass, domain.passwordrequirements) == false)) { err = "Invalid password"; errid = 3; } // Password does not meet requirements
5196
else if ((command.email != null) && (common.validateEmail(command.email, 1, 1024) == false)) { err = "Invalid email"; errid = 4; } // Check if this is a valid email address
5197
else if ((obj.crossDomain === true) && (command.domain != null) && ((typeof command.domain != 'string') || (parent.parent.config.domains[command.domain] == null))) { err = "Invalid domain"; errid = 5; } // Check if this is a valid domain
5198
+ else if ((domain.newaccountemaildomains != null) && Array.isArray(domain.newaccountemaildomains) && !common.validateEmailDomain(command.email, domain.newaccountemaildomains)) { err = "Email domain is not allowed. Only (" + domain.newaccountemaildomains.join(', ') + ") are allowed."; errid=30; args = [common.getEmailDomain(command.email), domain.newaccountemaildomains.join(', ')]; }
5199
else {
5200
newuserdomain = domain;
5201
if ((obj.crossDomain === true) && (command.domain != null)) { newuserdomain = parent.parent.config.domains[command.domain]; }
@@ -5215,7 +5216,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5216
obj.send({ action: 'adduser', responseid: command.responseid, result: err, msgid: errid });
5217
} else {
5218
// Send error back, user not found.
5218
- displayNotificationMessage(err, "New Account", 'ServerNotify', 1, errid);
5219
+ displayNotificationMessage(err, "New Account", 'ServerNotify', 1, errid, args);
5220
}
5221
return;
5222
}
views/default-mobile.handlebars
+2
-1
@@ -6437,7 +6437,8 @@
6437
"No phone number for this user",
6438
"SMS succesfuly sent.",
6439
"SMS error",
6440
- "SMS error: {0}"
6440
+ "SMS error: {0}",
6441
+ "Email domain \"{0}\" is not allowed. Only ({1}) are allowed" // 30
6442
];
6443
if (typeof n.titleid == 'number') { try { n.title = translatedTitles[n.titleid]; } catch (ex) { } }
6444
if (typeof n.msgid == 'number') { try { n.text = translatedMessages[n.msgid]; if (Array.isArray(n.args)) { n.text = format(n.text, n.args[0], n.args[1], n.args[2], n.args[3], n.args[4], n.args[5]); } } catch (ex) { } }
views/default.handlebars
+2
-1
@@ -16063,7 +16063,8 @@
16063
"No phone number for this user",
16064
"SMS succesfuly sent.",
16065
"SMS error",
16066
- "SMS error: {0}"
16066
+ "SMS error: {0}",
16067
+ "Email domain \"{0}\" is not allowed. Only ({1}) are allowed" // 30
16068
];
16069
if (typeof n.titleid == 'number') { try { n.title = translatedTitles[n.titleid]; } catch (ex) {} }
16070
if (typeof n.msgid == 'number') { try { n.text = translatedMessages[n.msgid]; if (Array.isArray(n.args)) { n.text = format(n.text, n.args[0], n.args[1], n.args[2], n.args[3], n.args[4], n.args[5]); } } catch (ex) { } }