Fixed device access control when using ManageAllDeviceGroups.
Ylian Saint-Hilaire committed
May 6, 2020 at 11:47 UTC
cae876fd4335149019ffdf949cdbf5697d4d0e15
2 files changed
+14
-1
meshcentral.js
+9
-1
@@ -1411,7 +1411,15 @@ function CreateMeshCentralServer(config, args) {
1411
1412
// Setup users that can see all device groups
1413
obj.config.settings.managealldevicegroups = [];
1414
- for (i in obj.config.domains) { if (Array.isArray(obj.config.domains[i].managealldevicegroups)) { for (var j in obj.config.domains[i].managealldevicegroups) { if (typeof obj.config.domains[i].managealldevicegroups[j] == 'string') { obj.config.settings.managealldevicegroups.push('user/' + i + '/' + obj.config.domains[i].managealldevicegroups[j]); } } } }
1414
+ for (i in obj.config.domains) {
1415
+ if (Array.isArray(obj.config.domains[i].managealldevicegroups)) {
1416
+ for (var j in obj.config.domains[i].managealldevicegroups) {
1417
+ if (typeof obj.config.domains[i].managealldevicegroups[j] == 'string') {
1418
+ obj.config.settings.managealldevicegroups.push('user/' + i + '/' + obj.config.domains[i].managealldevicegroups[j]);
1419
+ }
1420
+ }
1421
+ }
1422
+ }
1423
});
1424
});
1425
};
webserver.js
+5
@@ -4541,6 +4541,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4541
db.Get(nodeid, function (err, nodes) {
4542
if ((nodes == null) || (nodes.length != 1)) { func(null, 0, false); return; } // No such nodeid
4543
4544
+ // This is a super user that can see all device groups for a given domain
4545
+ if ((user.siteadmin == 0xFFFFFFFF) && (parent.config.settings.managealldevicegroups.indexOf(user._id) >= 0) && (nodes[0].domain == user.domain)) {
4546
+ func(nodes[0], 0xFFFFFFFF, true); return;
4547
+ }
4548
+
4549
// Check device link
4550
var rights = 0, visible = false, r = user.links[nodeid];
4551
if (r != null) {