Relay connections now require at least one user auth peer.
Ylian Saint-Hilaire committed
Sep 6, 2017 at 10:45 UTC
de2e5402f66feb9f80a8e81d06beff427a6cfac0
1 file changed
+11
meshrelay.js
+11
@@ -24,6 +24,9 @@ module.exports.CreateMeshRelay = function (parent, ws, req) {
24
25
if (obj.id == undefined) { obj.ws.close(); obj.id = null; return null; } // Attempt to connect without id, drop this.
26
27
+ // Check if this session is a logged in user, at least one of the two connections will need to be authenticated.
28
+ try { if ((req.session) && (req.session.userid) || (req.session.domainid == getDomain(req).id)) { obj.authenticated = true; } } catch (e) { }
29
+
30
// Validate that the id is valid, we only need to do this on non-authenticated sessions.
31
// TODO: Figure out when this needs to be done.
32
/*
@@ -42,6 +45,14 @@ module.exports.CreateMeshRelay = function (parent, ws, req) {
45
var relayinfo = parent.wsrelays[obj.id];
46
if (relayinfo) {
47
if (relayinfo.state == 1) {
48
+ // Check that at least one connection is authenticated
49
+ if ((obj.authenticated != true) && (relayinfo.peer1.authenticated != true)) {
50
+ obj.id = null;
51
+ obj.ws.close();
52
+ obj.parent.parent.debug(1, 'Relay without-auth: ' + obj.id + ' (' + obj.remoteaddr + ')');
53
+ return null;
54
+ }
55
+
56
// Connect to peer
57
obj.peer = relayinfo.peer1;
58
obj.peer.peer = obj;