Added option to remove clipboard get/set support.
Ylian Saint-Hilaire committed
Jul 15, 2021 at 13:58 UTC
dffafae46e9a00b52a68ed24ca78971b7f6b6c7a
4 files changed
+80
-65
meshcentral-config-schema.json
+2
@@ -643,6 +643,8 @@
643
},
644
"httpHeaders": { "type": "object", "additionalProperties": { "type": "string" } },
645
"agentConfig": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
646
+ "clipboardGet": { "type": "boolean", "default": true, "description": "When false, users can't set the clipboard of a remove device." },
647
+ "clipboardSet": { "type": "boolean", "default": true, "description": "When false, users can't get the clipboard of a remove device." },
648
"localSessionRecording": { "type": "boolean", "default": true, "description": "When false, removes the local recording feature on remote desktop." },
649
"sessionRecording": {
650
"type": "object",
meshuser.js
+6
-1
@@ -481,7 +481,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
481
var httpport = ((args.aliasport != null) ? args.aliasport : args.port);
482
483
// Build server information object
484
- var serverinfo = { domain: domain.id, name: domain.dns ? domain.dns : parent.certificates.CommonName, mpsname: parent.certificates.AmtMpsName, mpsport: mpsport, mpspass: args.mpspass, port: httpport, emailcheck: ((domain.mailserver != null) && (domain.auth != 'sspi') && (domain.auth != 'ldap') && (args.lanonly != true) && (parent.certificates.CommonName != null) && (parent.certificates.CommonName.indexOf('.') != -1) && (user._id.split('/')[2].startsWith('~') == false)), domainauth: (domain.auth == 'sspi'), serverTime: Date.now() };
484
+ const allFeatures = parent.getDomainUserFeatures(domain, user, req);
485
+ var serverinfo = { domain: domain.id, name: domain.dns ? domain.dns : parent.certificates.CommonName, mpsname: parent.certificates.AmtMpsName, mpsport: mpsport, mpspass: args.mpspass, port: httpport, emailcheck: ((domain.mailserver != null) && (domain.auth != 'sspi') && (domain.auth != 'ldap') && (args.lanonly != true) && (parent.certificates.CommonName != null) && (parent.certificates.CommonName.indexOf('.') != -1) && (user._id.split('/')[2].startsWith('~') == false)), domainauth: (domain.auth == 'sspi'), serverTime: Date.now(), features: allFeatures.features, features2: allFeatures.features2 };
486
serverinfo.languages = parent.renderLanguages;
487
serverinfo.tlshash = Buffer.from(parent.webCertificateFullHashs[domain.id], 'binary').toString('hex').toUpperCase(); // SHA384 of server HTTPS certificate
488
serverinfo.agentCertHash = parent.agentCertificateHashBase64;
@@ -891,6 +892,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
892
// Complete the nodeid if needed
893
if (command.nodeid.indexOf('/') == -1) { command.nodeid = 'node/' + domain.id + '/' + command.nodeid; }
894
895
+ // Check if getting / setting clipboard data is allowed
896
+ if ((command.type == 'getclip') && (domain.clipboardget == false)) { console.log('CG-EXIT'); break; }
897
+ if ((command.type == 'setclip') && (domain.clipboardset == false)) { console.log('CS-EXIT'); break; }
898
+
899
// Before routing this command, let's do some security checking.
900
// If this is a tunnel request, we need to make sure the NodeID in the URL matches the NodeID in the command.
901
if (command.type == 'tunnel') {
views/default.handlebars
+6
-6
@@ -7707,7 +7707,7 @@
7707
QE('connectbutton1h', hwonline);
7708
QV('deskFocusBtn', (desktop != null) && (desktop.contype == 2) && (deskState != 0) && (desktopsettings.showfocus));
7709
QE('DeskClip', deskState == 3);
7710
- QV('DeskClip', (inputAllowed) && (currentNode.agent) && (currentNode.agent.id != 11) && (currentNode.agent.id != 16) && ((desktop == null) || (desktop.contype != 2)) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null))); // Clipboard not supported on macOS
7710
+ QV('DeskClip', (inputAllowed) && (currentNode.agent) && ((features2 & 0x1800) != 0x1800) && (currentNode.agent.id != 11) && (currentNode.agent.id != 16) && ((desktop == null) || (desktop.contype != 2)) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null))); // Clipboard not supported on macOS
7711
QE('DeskESC', deskState == 3);
7712
QV('DeskESC', browserfullscreen && inputAllowed);
7713
QE('DeskType', deskState == 3);
@@ -7718,9 +7718,9 @@
7718
QV('DeskTimer', deskState == 3);
7719
7720
// Enable browser clipboard read if supported
7721
- QV('DeskClipboardOutButton', online && inputAllowed && (navigator.clipboard != null) && (navigator.clipboard.readText != null) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null)));
7722
- QV('d7deskAutoClipboardLabel', navigator.clipboard.readText != null);
7723
- QV('DeskClipboardInButton', online && inputAllowed && (navigator.clipboard != null) && (navigator.clipboard.writeText != null) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null)));
7721
+ QV('DeskClipboardOutButton', online && inputAllowed && ((features2 & 0x1000) == 0) && (navigator.clipboard != null) && (navigator.clipboard.readText != null) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null)));
7722
+ QV('d7deskAutoClipboardLabel', (navigator.clipboard.readText != null) && ((features2 & 0x1000) == 0));
7723
+ QV('DeskClipboardInButton', online && inputAllowed && ((features2 & 0x0800) == 0) && (navigator.clipboard != null) && (navigator.clipboard.writeText != null) && ((desktopsettings.autoclipboard != true) || (navigator.clipboard == null) || (navigator.clipboard.readText == null)));
7724
7725
if (deskState != 3) { QV('DeskInputLockedButton', false); QV('DeskInputUnLockedButton', false); }
7726
@@ -8482,8 +8482,8 @@
8482
if (xxdialogMode || desktop == null || desktop.State != 3) return;
8483
Q('DeskClip').blur();
8484
var x = '';
8485
- x += '<input id=dlgClipGet type=button value="Get Clipboard" style=width:120px onclick=showDeskClipGet()>';
8486
- x += '<input id=dlgClipSet type=button value="Set Clipboard" style=width:120px onclick=showDeskClipSet()>';
8485
+ if ((features2 & 0x0800) == 0) x += '<input id=dlgClipGet type=button value="Get Clipboard" style=width:120px onclick=showDeskClipGet()>';
8486
+ if ((features2 & 0x1000) == 0) x += '<input id=dlgClipSet type=button value="Set Clipboard" style=width:120px onclick=showDeskClipSet()>';
8487
x += '<div id=dlgClipStatus style="display:inline-block;margin-left:8px" ></div>';
8488
x += '<textarea id=d2clipText style="width:100%;height:184px;resize:none" maxlength=65535></textarea>';
8489
x += '<input type=button value="Close" style=width:80px;float:right onclick=dialogclose(0)><div style=height:26px;margin-top:3px><span id=linuxClipWarn style=display:none>' + "Remote clipboard is valid for 60 seconds." + '</span> </div><div></div>';
webserver.js
+66
-58
@@ -2468,7 +2468,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2468
}
2469
2470
function handleRootRequestEx(req, res, domain, direct) {
2471
- var nologout = false, user = null, features = 0, features2 = 0;
2471
+ var nologout = false, user = null;
2472
res.set({ 'Cache-Control': 'no-store' });
2473
2474
// Check if we have an incomplete domain name in the path
@@ -2640,61 +2640,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2640
var logoutcontrols = {};
2641
if (obj.args.nousers != true) { logoutcontrols.name = user.name; }
2642
2643
- // Give the web page a list of supported server features
2644
- features = 0;
2645
- features2 = 0;
2646
- if (obj.args.wanonly == true) { features += 0x00000001; } // WAN-only mode
2647
- if (obj.args.lanonly == true) { features += 0x00000002; } // LAN-only mode
2648
- if (obj.args.nousers == true) { features += 0x00000004; } // Single user mode
2649
- if (domain.userQuota == -1) { features += 0x00000008; } // No server files mode
2650
- if (obj.args.mpstlsoffload) { features += 0x00000010; } // No mutual-auth CIRA
2651
- if ((parent.config.settings.allowframing != null) || (domain.allowframing != null)) { features += 0x00000020; } // Allow site within iframe
2652
- if ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true)) { features += 0x00000040; } // Email invites
2653
- if (obj.args.webrtc == true) { features += 0x00000080; } // Enable WebRTC (Default false for now)
2654
- // 0x00000100 --> This feature flag is free for future use.
2655
- if (obj.args.allowhighqualitydesktop !== false) { features += 0x00000200; } // Enable AllowHighQualityDesktop (Default true)
2656
- if ((obj.args.lanonly == true) || (obj.args.mpsport == 0)) { features += 0x00000400; } // No CIRA
2657
- if ((obj.parent.serverSelfWriteAllowed == true) && (dbGetFunc.user != null) && (dbGetFunc.user.siteadmin == 0xFFFFFFFF)) { features += 0x00000800; } // Server can self-write (Allows self-update)
2658
- if ((parent.config.settings.no2factorauth !== true) && (domain.auth != 'sspi') && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.nousers !== true) && (dbGetFunc.user._id.split('/')[2][0] != '~')) { features += 0x00001000; } // 2FA login supported
2659
- if (domain.agentnoproxy === true) { features += 0x00002000; } // Indicates that agents should be installed without using a HTTP proxy
2660
- if ((parent.config.settings.no2factorauth !== true) && domain.yubikey && domain.yubikey.id && domain.yubikey.secret && (dbGetFunc.user._id.split('/')[2][0] != '~')) { features += 0x00004000; } // Indicates Yubikey support
2661
- if (domain.geolocation == true) { features += 0x00008000; } // Enable geo-location features
2662
- if ((domain.passwordrequirements != null) && (domain.passwordrequirements.hint === true)) { features += 0x00010000; } // Enable password hints
2663
- if (parent.config.settings.no2factorauth !== true) { features += 0x00020000; } // Enable WebAuthn/FIDO2 support
2664
- if ((obj.args.nousers != true) && (domain.passwordrequirements != null) && (domain.passwordrequirements.force2factor === true) && (dbGetFunc.user._id.split('/')[2][0] != '~')) {
2665
- // Check if we can skip 2nd factor auth because of the source IP address
2666
- var skip2factor = false;
2667
- if ((dbGetFunc.req != null) && (dbGetFunc.req.clientIp != null) && (domain.passwordrequirements != null) && (domain.passwordrequirements.skip2factor != null)) {
2668
- for (var i in domain.passwordrequirements.skip2factor) {
2669
- if (require('ipcheck').match(dbGetFunc.req.clientIp, domain.passwordrequirements.skip2factor[i]) === true) { skip2factor = true; }
2670
- }
2671
- }
2672
- if (skip2factor == false) { features += 0x00040000; } // Force 2-factor auth
2673
- }
2674
- if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { features += 0x00080000; } // LDAP or SSPI in use, warn that users must login first before adding a user to a group.
2675
- if (domain.amtacmactivation) { features += 0x00100000; } // Intel AMT ACM activation/upgrade is possible
2676
- if (domain.usernameisemail) { features += 0x00200000; } // Username is email address
2677
- if (parent.mqttbroker != null) { features += 0x00400000; } // This server supports MQTT channels
2678
- if (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null)) { features += 0x00800000; } // using email for 2FA is allowed
2679
- if (domain.agentinvitecodes == true) { features += 0x01000000; } // Support for agent invite codes
2680
- if (parent.smsserver != null) { features += 0x02000000; } // SMS messaging is supported
2681
- if ((parent.smsserver != null) && ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false))) { features += 0x04000000; } // SMS 2FA is allowed
2682
- if (domain.sessionrecording != null) { features += 0x08000000; } // Server recordings enabled
2683
- if (domain.urlswitching === false) { features += 0x10000000; } // Disables the URL switching feature
2684
- if (domain.novnc === false) { features += 0x20000000; } // Disables noVNC
2685
- if (domain.mstsc !== true) { features += 0x40000000; } // Disables MSTSC.js
2686
- if (obj.isTrustedCert(domain) == false) { features += 0x80000000; } // Indicate we are not using a trusted certificate
2687
- if (obj.parent.amtManager != null) { features2 += 0x00000001; } // Indicates that the Intel AMT manager is active
2688
- if (obj.parent.firebase != null) { features2 += 0x00000002; } // Indicates the server supports Firebase push messaging
2689
- if ((obj.parent.firebase != null) && (obj.parent.firebase.pushOnly != true)) { features2 += 0x00000004; } // Indicates the server supports Firebase two-way push messaging
2690
- if (obj.parent.webpush != null) { features2 += 0x00000008; } // Indicates web push is enabled
2691
- if (((obj.args.noagentupdate == 1) || (obj.args.noagentupdate == true))) { features2 += 0x00000010; } // No agent update
2692
- if (parent.amtProvisioningServer != null) { features2 += 0x00000020; } // Intel AMT LAN provisioning server
2693
- if (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.push2factor != false)) && (obj.parent.firebase != null)) { features2 += 0x00000040; } // Indicates device push notification 2FA is enabled
2694
- if ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.logintokens != false)) { features2 += 0x00000080; } // Indicates login tokens are allowed
2695
- if (req.session.loginToken != null) { features2 += 0x00000100; } // LoginToken mode, no account changes.
2696
- if (domain.ssh == true) { features2 += 0x00000200; } // SSH is enabled
2697
- if (domain.localsessionrecording === false) { features2 += 0x00000400; } // Disable local recording feature
2643
+ // Give the web page a list of supported server features for this domain and user
2644
+ const allFeatures = obj.getDomainUserFeatures(domain, dbGetFunc.user, dbGetFunc.req);
2645
2646
// Create a authentication cookie
2647
const authCookie = obj.parent.encodeCookie({ userid: dbGetFunc.user._id, domainid: domain.id, ip: req.clientIp }, obj.parent.loginCookieEncryptionKey);
@@ -2759,8 +2706,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2706
serverRedirPort: args.redirport,
2707
serverPublicPort: httpsPort,
2708
serverfeatures: serverFeatures,
2762
- features: features,
2763
- features2: features2,
2709
+ features: allFeatures.features,
2710
+ features2: allFeatures.features2,
2711
sessiontime: (args.sessiontime) ? args.sessiontime : 60,
2712
mpspass: args.mpspass,
2713
passRequirements: passRequirements,
@@ -2813,6 +2760,67 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2760
}
2761
}
2762
2763
+ // Return a list of server supported features for a given domain and user
2764
+ obj.getDomainUserFeatures = function(domain, user, req) {
2765
+ var features = 0;
2766
+ var features2 = 0;
2767
+ if (obj.args.wanonly == true) { features += 0x00000001; } // WAN-only mode
2768
+ if (obj.args.lanonly == true) { features += 0x00000002; } // LAN-only mode
2769
+ if (obj.args.nousers == true) { features += 0x00000004; } // Single user mode
2770
+ if (domain.userQuota == -1) { features += 0x00000008; } // No server files mode
2771
+ if (obj.args.mpstlsoffload) { features += 0x00000010; } // No mutual-auth CIRA
2772
+ if ((parent.config.settings.allowframing != null) || (domain.allowframing != null)) { features += 0x00000020; } // Allow site within iframe
2773
+ if ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true)) { features += 0x00000040; } // Email invites
2774
+ if (obj.args.webrtc == true) { features += 0x00000080; } // Enable WebRTC (Default false for now)
2775
+ // 0x00000100 --> This feature flag is free for future use.
2776
+ if (obj.args.allowhighqualitydesktop !== false) { features += 0x00000200; } // Enable AllowHighQualityDesktop (Default true)
2777
+ if ((obj.args.lanonly == true) || (obj.args.mpsport == 0)) { features += 0x00000400; } // No CIRA
2778
+ if ((obj.parent.serverSelfWriteAllowed == true) && (user != null) && (user.siteadmin == 0xFFFFFFFF)) { features += 0x00000800; } // Server can self-write (Allows self-update)
2779
+ if ((parent.config.settings.no2factorauth !== true) && (domain.auth != 'sspi') && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.nousers !== true) && (user._id.split('/')[2][0] != '~')) { features += 0x00001000; } // 2FA login supported
2780
+ if (domain.agentnoproxy === true) { features += 0x00002000; } // Indicates that agents should be installed without using a HTTP proxy
2781
+ if ((parent.config.settings.no2factorauth !== true) && domain.yubikey && domain.yubikey.id && domain.yubikey.secret && (user._id.split('/')[2][0] != '~')) { features += 0x00004000; } // Indicates Yubikey support
2782
+ if (domain.geolocation == true) { features += 0x00008000; } // Enable geo-location features
2783
+ if ((domain.passwordrequirements != null) && (domain.passwordrequirements.hint === true)) { features += 0x00010000; } // Enable password hints
2784
+ if (parent.config.settings.no2factorauth !== true) { features += 0x00020000; } // Enable WebAuthn/FIDO2 support
2785
+ if ((obj.args.nousers != true) && (domain.passwordrequirements != null) && (domain.passwordrequirements.force2factor === true) && (user._id.split('/')[2][0] != '~')) {
2786
+ // Check if we can skip 2nd factor auth because of the source IP address
2787
+ var skip2factor = false;
2788
+ if ((req != null) && (req.clientIp != null) && (domain.passwordrequirements != null) && (domain.passwordrequirements.skip2factor != null)) {
2789
+ for (var i in domain.passwordrequirements.skip2factor) {
2790
+ if (require('ipcheck').match(req.clientIp, domain.passwordrequirements.skip2factor[i]) === true) { skip2factor = true; }
2791
+ }
2792
+ }
2793
+ if (skip2factor == false) { features += 0x00040000; } // Force 2-factor auth
2794
+ }
2795
+ if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { features += 0x00080000; } // LDAP or SSPI in use, warn that users must login first before adding a user to a group.
2796
+ if (domain.amtacmactivation) { features += 0x00100000; } // Intel AMT ACM activation/upgrade is possible
2797
+ if (domain.usernameisemail) { features += 0x00200000; } // Username is email address
2798
+ if (parent.mqttbroker != null) { features += 0x00400000; } // This server supports MQTT channels
2799
+ if (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null)) { features += 0x00800000; } // using email for 2FA is allowed
2800
+ if (domain.agentinvitecodes == true) { features += 0x01000000; } // Support for agent invite codes
2801
+ if (parent.smsserver != null) { features += 0x02000000; } // SMS messaging is supported
2802
+ if ((parent.smsserver != null) && ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false))) { features += 0x04000000; } // SMS 2FA is allowed
2803
+ if (domain.sessionrecording != null) { features += 0x08000000; } // Server recordings enabled
2804
+ if (domain.urlswitching === false) { features += 0x10000000; } // Disables the URL switching feature
2805
+ if (domain.novnc === false) { features += 0x20000000; } // Disables noVNC
2806
+ if (domain.mstsc !== true) { features += 0x40000000; } // Disables MSTSC.js
2807
+ if (obj.isTrustedCert(domain) == false) { features += 0x80000000; } // Indicate we are not using a trusted certificate
2808
+ if (obj.parent.amtManager != null) { features2 += 0x00000001; } // Indicates that the Intel AMT manager is active
2809
+ if (obj.parent.firebase != null) { features2 += 0x00000002; } // Indicates the server supports Firebase push messaging
2810
+ if ((obj.parent.firebase != null) && (obj.parent.firebase.pushOnly != true)) { features2 += 0x00000004; } // Indicates the server supports Firebase two-way push messaging
2811
+ if (obj.parent.webpush != null) { features2 += 0x00000008; } // Indicates web push is enabled
2812
+ if (((obj.args.noagentupdate == 1) || (obj.args.noagentupdate == true))) { features2 += 0x00000010; } // No agent update
2813
+ if (parent.amtProvisioningServer != null) { features2 += 0x00000020; } // Intel AMT LAN provisioning server
2814
+ if (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.push2factor != false)) && (obj.parent.firebase != null)) { features2 += 0x00000040; } // Indicates device push notification 2FA is enabled
2815
+ if ((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.logintokens != false)) { features2 += 0x00000080; } // Indicates login tokens are allowed
2816
+ if (req.session.loginToken != null) { features2 += 0x00000100; } // LoginToken mode, no account changes.
2817
+ if (domain.ssh == true) { features2 += 0x00000200; } // SSH is enabled
2818
+ if (domain.localsessionrecording === false) { features2 += 0x00000400; } // Disable local recording feature
2819
+ if (domain.clipboardget == false) { features2 += 0x00000800; } // Disable clipboard get
2820
+ if (domain.clipboardset == false) { features2 += 0x00001000; } // Disable clipboard set
2821
+ return { features: features, features2: features2 };
2822
+ }
2823
+
2824
function handleRootRequestLogin(req, res, domain, hardwareKeyChallenge, passRequirements) {
2825
parent.debug('web', 'handleRootRequestLogin()');
2826
var features = 0;