e5544fe1 · cryptotaxi247/MeshCentral

@@ -737,6 +737,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

737 req.session.userid = userid;

738 req.session.domainid = domain.id;

739 req.session.currentNode = '';

740 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

741 if (req.body.viewmode) { req.session.viewmode = req.body.viewmode; }

742 if (req.body.host) {

743 // TODO: This is a terrible search!!! FIX THIS.

@@ -853,6 +854,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

854 obj.users[user._id] = user;

855 req.session.userid = user._id;

856 req.session.domainid = domain.id;

857 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

858 // Create a user, generate a salt and hash the password

859 require('./pass').hash(req.body.password1, function (err, salt, hash, tag) {

860 if (err) throw err;

@@ -937,6 +939,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

939 parent.debug('web', 'handleResetPasswordRequest: success');

940 req.session.userid = userid;

941 req.session.domainid = domain.id;

942 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

943 completeLoginRequest(req, res, domain, obj.users[userid], userid, req.session.tokenusername, req.session.tokenpassword, direct);

944 }, 0);

945 }

@@ -1344,6 +1347,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1347 req.session.userid = userid;

1348 req.session.domainid = domain.id;

1349 req.session.currentNode = '';

1350 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

1351 handleRootRequestEx(req, res, domain, direct);

1352 });

1353 } else {

@@ -1369,6 +1373,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1373 req.session.userid = 'user/' + domain.id + '/~';

1374 req.session.domainid = domain.id;

1375 req.session.currentNode = '';

1376 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

1377 if (obj.users[req.session.userid] == null) {

1378 // Create the dummy user ~ with impossible password

1379 parent.debug('web', 'handleRootRequestEx: created dummy user in nouser mode.');

@@ -1382,8 +1387,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1387 req.session.userid = 'user/' + domain.id + '/' + obj.args.user.toLowerCase();

1388 req.session.domainid = domain.id;

1389 req.session.currentNode = '';

1390 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

1391 } else if (req.query.login && (obj.parent.loginCookieEncryptionKey != null)) {

1392 var loginCookie = obj.parent.decodeCookie(req.query.login, obj.parent.loginCookieEncryptionKey, 60); // 60 minute timeout

1393 + if ((loginCookie != null) && (loginCookie.ip != null) && (loginCookie.ip != cleanRemoteAddr(req.ip))) { loginCookie = null; } // If the cookie if binded to an IP address, check here.

1394 if ((loginCookie != null) && (loginCookie.a == 3) && (loginCookie.u != null) && (loginCookie.u.split('/')[1] == domain.id)) {

1395 // If a login cookie was provided, setup the session here.

1396 parent.debug('web', 'handleRootRequestEx: cookie auth ok.');

@@ -1391,6 +1398,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1398 req.session.userid = loginCookie.u;

1399 req.session.domainid = domain.id;

1400 req.session.currentNode = '';

1401 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

1402 } else {

1403 parent.debug('web', 'handleRootRequestEx: cookie auth failed.');

1404 }

@@ -1407,6 +1415,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1415 req.session.usersGroups = req.connection.userGroups;

1416 req.session.domainid = domain.id;

1417 req.session.currentNode = '';

1418 + req.session.ip = cleanRemoteAddr(req.ip); // Bind this session to the IP address of the request

1419

1420 // Check if this user exists, create it if not.

1421 user = obj.users[req.session.userid];

@@ -1499,12 +1508,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1508 if (domain.usernameisemail) { features += 0x00200000; } // Username is email address

1509

1510 // Create a authentication cookie

1502 - const authCookie = obj.parent.encodeCookie({ userid: user._id, domainid: domain.id }, obj.parent.loginCookieEncryptionKey);

1511 + const authCookie = obj.parent.encodeCookie({ userid: user._id, domainid: domain.id, ip: cleanRemoteAddr(req.ip) }, obj.parent.loginCookieEncryptionKey);

1512

1513 // Send the master web application

1514 if ((!obj.args.user) && (obj.args.nousers != true) && (nologout == false)) { logoutcontrol += ' <a href=' + domain.url + 'logout?' + Math.random() + ' style=color:white>Logout</a>'; } // If a default user is in use or no user mode, don't display the logout button

1515 var httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified

1516

1517 + // Clean up the U2F challenge is needed

1518 + if (req.session.u2fchallenge) { delete req.session.u2fchallenge; };

1519 +

1520 // Fetch the web state

1521 parent.debug('web', 'handleRootRequestEx: success.');

1522 obj.db.Get('ws' + user._id, function (err, states) {

@@ -3133,7 +3145,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

3145 keys: [obj.args.sessionkey], // If multiple instances of this server are behind a load-balancer, this secret must be the same for all instances

3146 secure: ((obj.args.notls != true) && (obj.args.tlsoffload == null)) // Use this cookie only over TLS (Check this: https://expressjs.com/en/guide/behind-proxies.html)

3147 }

3136 - if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; }

3148 + if (obj.args.sessionsamesite != null) { sessionOptions.sameSite = obj.args.sessionsamesite; } else { sessionOptions.sameSite = 'strict'; }

3149 if (obj.args.sessiontime != null) { sessionOptions.maxAge = (obj.args.sessiontime * 60 * 1000); }

3150 obj.app.use(obj.session(sessionOptions));

3151

@@ -3159,6 +3171,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

3171 });

3172 }

3173

3174 + // Check the session if bound to the external IP address

3175 + if ((req.session.ip != null) && (req.session.ip == cleanRemoteAddr(req.ip))) { req.session = {}; }

3176 +

3177 // Detect if this is a file sharing domain, if so, just share files.

3178 if ((domain != null) && (domain.share != null)) {

3179 var rpath;

@@ -3357,6 +3372,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

3372 // This is a encrypted cookie authentication

3373 var cookie = obj.parent.decodeCookie(req.query.auth, obj.parent.loginCookieEncryptionKey, 240); // Cookie with 4 hour timeout

3374 if ((cookie == null) && (obj.parent.multiServer != null)) { cookie = obj.parent.decodeCookie(req.query.auth, obj.parent.serverKey, 240); } // Try the server key

3375 + if ((cookie != null) && (cookie.ip != null) && (cookie.ip != cleanRemoteAddr(req.ip))) { cookie = null; } // If the cookie if binded to an IP address, check here.

3376 if ((cookie != null) && (obj.users[cookie.userid]) && (cookie.domainid == domain.id)) {

3377 // Valid cookie, we are authenticated

3378 func(ws, req, domain, obj.users[cookie.userid], cookie);

Added IP binding to session and encoded cookies.