Server code cleanup & fixes.

Ylian Saint-Hilaire committed Jan 5, 2019 at 12:04 UTC f18d201188d029d5384dad92acbfb34c1ec9cc75
5 files changed +62 -128
common.js
+2 -1
@@ -14,6 +14,7 @@
14 /*jshint esversion: 6 */
15 "use strict";
16
17 +const fs = require("fs");
18 const crypto = require("crypto");
19
20 // Binary encoding and decoding functions
@@ -171,4 +172,4 @@ module.exports.checkPasswordRequirements = function(password, requirements) {
172 if (requirements.upper && (upper < requirements.upper)) return false;
173 if (requirements.nonalpha && (nonalpha < requirements.nonalpha)) return false;
174 return true;
174 -}
\ No newline at end of file
175 +}
meshcentral.js
-21
@@ -1235,27 +1235,6 @@ function CreateMeshCentralServer(config, args) {
1235 function logWarnEvent(msg) { if (obj.servicelog != null) { obj.servicelog.warn(msg); } console.log(msg); }
1236 function logErrorEvent(msg) { if (obj.servicelog != null) { obj.servicelog.error(msg); } console.error(msg); }
1237
1238 - // Read entire file and return it in callback function
1239 - obj.readEntireTextFile = function(filepath, func) {
1240 - var called = false;
1241 - try {
1242 - obj.fs.open(filepath, 'r', function (err, fd) {
1243 - if (fd == null) { func(null); return; }
1244 - obj.fs.fstat(fd, function (err, stats) {
1245 - var bufferSize = stats.size, chunkSize = 512, buffer = Buffer.from(bufferSize), bytesRead = 0;
1246 - while (bytesRead < bufferSize) {
1247 - if ((bytesRead + chunkSize) > bufferSize) { chunkSize = (bufferSize - bytesRead); }
1248 - obj.fs.readSync(fd, buffer, bytesRead, chunkSize, bytesRead);
1249 - bytesRead += chunkSize;
1250 - }
1251 - obj.fs.close(fd);
1252 - called = true;
1253 - func(buffer.toString('utf8', 0, bufferSize));
1254 - });
1255 - });
1256 - } catch (e) { console.log(e); if (called == false) { func(null); } }
1257 - }
1258 -
1238 // Return the path of a file into the meshcentral-data path
1239 obj.getConfigFilePath = function (filename) {
1240 if ((obj.config != null) && (obj.config.configfiles != null) && (obj.config.configfiles[filename] != null) && (typeof obj.config.configfiles[filename] == 'string')) {
meshuser.js
+4 -25
@@ -717,7 +717,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
717 {
718 // Load the server error log
719 if ((user.siteadmin & 16) == 0) break;
720 - obj.parent.parent.readEntireTextFile(obj.parent.parent.getConfigFilePath('mesherrors.txt'), function (data) { try { ws.send(JSON.stringify({ action: 'servererrors', data: data })); } catch (ex) { } });
720 + obj.parent.parent.fs.readFile(obj.parent.parent.getConfigFilePath('mesherrors.txt'), 'utf8', function (err, data) { try { ws.send(JSON.stringify({ action: 'servererrors', data: data })); } catch (ex) { } });
721 break;
722 }
723 case 'serverclearerrorlog':
@@ -1213,8 +1213,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1213 // Send a mesh agent core to the mesh agent
1214 var file = obj.parent.getServerFilePath(user, domain, command.path);
1215 if (file != null) {
1216 - obj.parent.readEntireTextFile(file.fullpath, function (data) {
1217 - if (data != null) {
1216 + obj.parent.parent.fs.readFile(file.fullpath, 'utf8', function (err, data) {
1217 + if (err != null) {
1218 data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
1219 obj.parent.sendMeshAgentCore(user, domain, command.nodeid, data);
1220 }
@@ -1238,8 +1238,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1238 case 'close':
1239 {
1240 // Close the web socket session
1241 - console.log('CLOSING1');
1242 - if (obj.req.session && obj.req.session.ws && obj.req.session.ws == ws) { console.log('CLOSING2'); delete obj.req.session.ws; }
1241 + if (obj.req.session && obj.req.session.ws && obj.req.session.ws == ws) { delete obj.req.session.ws; }
1242 try { ws.close(); } catch (e) { }
1243 break;
1244 }
@@ -1397,26 +1396,6 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1396 }
1397 }
1398
1400 - // Read entire file and return it in callback function
1401 - function readEntireTextFile(filepath, func) {
1402 - var called = false;
1403 - try {
1404 - obj.fs.open(filepath, 'r', function (err, fd) {
1405 - obj.fs.fstat(fd, function (err, stats) {
1406 - var bufferSize = stats.size, chunkSize = 512, buffer = Buffer.from(bufferSize), bytesRead = 0;
1407 - while (bytesRead < bufferSize) {
1408 - if ((bytesRead + chunkSize) > bufferSize) { chunkSize = (bufferSize - bytesRead); }
1409 - obj.fs.readSync(fd, buffer, bytesRead, chunkSize, bytesRead);
1410 - bytesRead += chunkSize;
1411 - }
1412 - obj.fs.close(fd);
1413 - called = true;
1414 - func(buffer.toString('utf8', 0, bufferSize));
1415 - });
1416 - });
1417 - } catch (e) { if (called == false) { func(null); } }
1418 - }
1419 -
1399 // Read the folder and all sub-folders and serialize that into json.
1400 function readFilesRec(path) {
1401 var r = {}, dir = obj.fs.readdirSync(path);
package.json
+1 -1
@@ -1,6 +1,6 @@
1 {
2 "name": "meshcentral",
3 - "version": "0.2.5-r",
3 + "version": "0.2.5-s",
4 "keywords": [
5 "Remote Management",
6 "Intel AMT",
webserver.js
+55 -80
@@ -300,12 +300,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
300 }
301
302 // Check if the source IP address is allowed, return domain if allowed
303 - function checkUserIpAddress(req, res, rootonly) {
304 - if ((obj.userAllowedIp != null) && (checkUserIpAddressEx(req, res, obj.userAllowedIp) == false)) { return null; }
305 - if (rootonly == true) { return; }
306 - var domain;
307 - if (req.url) { domain = getDomain(req); } else { domain = getDomain(res); }
308 - if (domain.userallowedip == null) return domain;
303 + function checkUserIpAddress(req, res) {
304 + if (checkUserIpAddressEx(req, res, obj.userAllowedIp) == false) { return null; }
305 + const domain = (req.url ? getDomain(req) : getDomain(res));
306 if (checkUserIpAddressEx(req, res, domain.userallowedip) == false) { return null; }
307 return domain;
308 }
@@ -322,7 +319,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
319 }
320
321 function handleLogoutRequest(req, res) {
325 - var domain = checkUserIpAddress(req, res);
322 + const domain = checkUserIpAddress(req, res);
323 if (domain == null) return;
324 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
325 // Destroy the user's session to log them out will be re-created next request
@@ -335,7 +332,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
332 }
333
334 function handleLoginRequest(req, res) {
338 - var domain = checkUserIpAddress(req, res);
335 + const domain = checkUserIpAddress(req, res);
336 if (domain == null) return;
337 obj.authenticate(req.body.username, req.body.password, domain, function (err, userid, passhint) {
338 if (userid) {
@@ -391,7 +388,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
388 }
389
390 function handleCreateAccountRequest(req, res) {
394 - var domain = checkUserIpAddress(req, res);
391 + const domain = checkUserIpAddress(req, res);
392 if (domain == null) return;
393 if ((domain.newaccounts === 0) || (domain.newaccounts === false)) { res.sendStatus(401); return; }
394 if (!obj.common.validateUsername(req.body.username, 1, 64) || !obj.common.validateEmail(req.body.email, 1, 256) || !obj.common.validateString(req.body.password1, 1, 256) || !obj.common.validateString(req.body.password2, 1, 256) || (req.body.password1 != req.body.password2) || req.body.username == '~' || !obj.common.checkPasswordRequirements(req.body.password1, domain.passwordrequirements)) {
@@ -445,7 +442,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
442
443 // Called to process an account reset request
444 function handleResetAccountRequest(req, res) {
448 - var domain = checkUserIpAddress(req, res);
445 + const domain = checkUserIpAddress(req, res);
446 if (domain == null) return;
447 if ((domain.newaccounts === 0) || (domain.newaccounts === false)) { res.sendStatus(401); return; }
448 if (!req.body.email || checkEmail(req.body.email) == false) {
@@ -477,7 +474,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
474
475 // Called to process a web based email verification request
476 function handleCheckMailRequest(req, res) {
480 - var domain = checkUserIpAddress(req, res);
477 + const domain = checkUserIpAddress(req, res);
478 if (domain == null) return;
479 if (req.query.c != null) {
480 var cookie = obj.parent.decodeCookie(req.query.c, obj.parent.mailserver.mailCookieEncryptionKey, 30);
@@ -577,7 +574,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
574 }
575
576 function handleDeleteAccountRequest(req, res) {
580 - var domain = checkUserIpAddress(req, res);
577 + const domain = checkUserIpAddress(req, res);
578 if (domain == null) return;
579 // Check if the user is logged and we have all required parameters
580 if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url); return; }
@@ -621,7 +618,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
618
619 // Handle password changes
620 function handlePasswordChangeRequest(req, res) {
624 - var domain = checkUserIpAddress(req, res);
621 + const domain = checkUserIpAddress(req, res);
622 if (domain == null) return;
623 // Check if the user is logged and we have all required parameters
624 if (!req.session || !req.session.userid || !req.body.apassword1 || (req.body.apassword1 != req.body.apassword2) || (req.session.domainid != domain.id)) { res.redirect(domain.url); return; }
@@ -645,7 +642,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
642
643 // Indicates that any request to "/" should render "default" or "login" depending on login state
644 function handleRootRequest(req, res) {
648 - var domain = checkUserIpAddress(req, res);
645 + const domain = checkUserIpAddress(req, res);
646 if (domain == null) return;
647 if (!obj.args) { res.sendStatus(500); return; }
648
@@ -829,14 +826,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
826
827 // Render the terms of service.
828 function handleTermsRequest(req, res) {
832 - var domain = checkUserIpAddress(req, res);
829 + const domain = checkUserIpAddress(req, res);
830 if (domain == null) return;
831
832 // See if there is a terms.txt file in meshcentral-data
833 var p = obj.path.join(obj.parent.datapath, 'terms.txt');
834 if (obj.fs.existsSync(p)) {
838 - readEntireTextFile(p, function (data) {
839 - if (data == null) { res.sendStatus(404); return; }
835 + obj.fs.readFile(p, 'utf8', function (err, data) {
836 + if (err != null) { res.sendStatus(404); return; }
837
838 // Send the terms
839 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0' });
@@ -881,14 +878,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
878
879 // Returns the mesh server root certificate
880 function handleRootCertRequest(req, res) {
884 - if (checkUserIpAddress(req, res, true) == false) { return; }
881 + if (checkUserIpAddressEx(req, res, obj.userAllowedIp) === false) { return; } // Check server-wide IP filter only.
882 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=' + certificates.RootName + '.cer' });
883 res.send(Buffer.from(getRootCertBase64(), 'base64'));
884 }
885
886 // Returns an mescript for Intel AMT configuration
887 function handleMeScriptRequest(req, res) {
891 - if (checkUserIpAddress(req, res, true) == false) { return; }
888 + if (checkUserIpAddressEx(req, res, obj.userAllowedIp) === false) { return; } // Check server-wide IP filter only.
889 if (req.query.type == 1) {
890 var filename = 'cira_setup.mescript';
891 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=' + filename });
@@ -899,8 +896,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
896
897 if ((serverNameSplit.length == 4) && (parseInt(serverNameSplit[0]) == serverNameSplit[0]) && (parseInt(serverNameSplit[1]) == serverNameSplit[1]) && (parseInt(serverNameSplit[2]) == serverNameSplit[2]) && (parseInt(serverNameSplit[3]) == serverNameSplit[3])) {
898 // Server name is an IPv4 address
902 - readEntireTextFile(obj.parent.path.join(__dirname, 'public/scripts/cira_setup_script_ip.mescript'), function (data) {
903 - if (data == null) { res.sendStatus(404); return; }
899 + obj.fs.readFile(obj.parent.path.join(__dirname, 'public/scripts/cira_setup_script_ip.mescript'), 'utf8', function (err, data) {
900 + if (err != null) { res.sendStatus(404); return; }
901 var scriptFile = JSON.parse(data);
902
903 // Change a few things in the script
@@ -925,8 +922,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
922 });
923 } else {
924 // Server name is a hostname
928 - readEntireTextFile(obj.parent.path.join(__dirname, 'public/scripts/cira_setup_script_dns.mescript'), function (data) {
929 - if (data == null) { res.sendStatus(404); return; }
925 + obj.fs.readFile(obj.parent.path.join(__dirname, 'public/scripts/cira_setup_script_dns.mescript'), 'utf8', function (err, data) {
926 + if (err != null) { res.sendStatus(404); return; }
927 var scriptFile = JSON.parse(data);
928
929 // Change a few things in the script
@@ -953,8 +950,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
950 else if (req.query.type == 2) {
951 var filename = 'cira_cleanup.mescript';
952 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=' + filename });
956 - readEntireTextFile(obj.parent.path.join(__dirname, 'public/scripts/cira_cleanup.mescript'), function (data) {
957 - if (data == null) { res.sendStatus(404); return; }
953 + obj.fs.readFile(obj.parent.path.join(__dirname, 'public/scripts/cira_cleanup.mescript'), 'utf8', function (err, data) {
954 + if (err != null) { res.sendStatus(404); return; }
955 res.send(Buffer.from(data));
956 });
957 }
@@ -962,7 +959,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
959
960 // Handle user public file downloads
961 function handleDownloadUserFiles(req, res) {
965 - var domain = checkUserIpAddress(req, res);
962 + const domain = checkUserIpAddress(req, res);
963 if (domain == null) return;
964 if (obj.common.validateString(req.path, 1, 4096) == false) { res.sendStatus(404); return; }
965 var domainname = 'domain', spliturl = decodeURIComponent(req.path).split('/'), filename = '';
@@ -987,7 +984,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
984
985 // Handle logo request
986 function handleLogoRequest(req, res) {
990 - var domain = checkUserIpAddress(req, res);
987 + const domain = checkUserIpAddress(req, res);
988
989 res.set({ 'Cache-Control': 'max-age=86400' }); // 1 day
990 if ((domain != null) && domain.titlepicture) {
@@ -1034,12 +1031,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1031
1032 // Download a file from the server
1033 function handleDownloadFile(req, res) {
1037 - var domain = checkUserIpAddress(req, res);
1034 + const domain = checkUserIpAddress(req, res);
1035 if (domain == null) return;
1036 if ((req.query.link == null) || (req.session == null) || (req.session.userid == null) || (domain == null) || (domain.userQuota == -1)) { res.sendStatus(404); return; }
1040 - var user = obj.users[req.session.userid];
1037 + const user = obj.users[req.session.userid];
1038 if (user == null) { res.sendStatus(404); return; }
1042 - var file = obj.getServerFilePath(user, domain, req.query.link);
1039 + const file = obj.getServerFilePath(user, domain, req.query.link);
1040 if (file == null) { res.sendStatus(404); return; }
1041 res.set({ 'Cache-Control': 'no-cache, no-store, must-revalidate', 'Pragma': 'no-cache', 'Expires': '0', 'Content-Type': 'application/octet-stream', 'Content-Disposition': 'attachment; filename=\"' + file.name + '\"' });
1042 try { res.sendFile(file.fullpath); } catch (e) { res.sendStatus(404); }
@@ -1047,20 +1044,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1044
1045 // Upload a MeshCore.js file to the server
1046 function handleUploadMeshCoreFile(req, res) {
1050 - var domain = checkUserIpAddress(req, res);
1047 + const domain = checkUserIpAddress(req, res);
1048 if (domain == null) return;
1049 if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
1053 - var user = obj.users[req.session.userid];
1050 + const user = obj.users[req.session.userid];
1051 if (user.siteadmin != 0xFFFFFFFF) { res.sendStatus(401); return; } // Check if we have mesh core upload rights (Full admin only)
1052
1056 - var multiparty = require('multiparty');
1057 - var form = new multiparty.Form();
1053 + const multiparty = require('multiparty');
1054 + const form = new multiparty.Form();
1055 form.parse(req, function (err, fields, files) {
1056 if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
1057 for (var i in files.files) {
1058 var file = files.files[i];
1062 - readEntireTextFile(file.path, function (data) {
1063 - if (data == null) return;
1059 + obj.fs.readFile(file.path, 'utf8', function (err, data) {
1060 + if (err != null) return;
1061 data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
1062 obj.sendMeshAgentCore(user, domain, fields.attrib[0], data); // Upload the core
1063 try { obj.fs.unlinkSync(file.path); } catch (e) { }
@@ -1072,14 +1069,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1069
1070 // Upload a file to the server
1071 function handleUploadFile(req, res) {
1075 - var domain = checkUserIpAddress(req, res);
1072 + const domain = checkUserIpAddress(req, res);
1073 if (domain == null) return;
1074 if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (domain.userQuota == -1)) { res.sendStatus(401); return; }
1078 - var user = obj.users[req.session.userid];
1075 + const user = obj.users[req.session.userid];
1076 if ((user.siteadmin & 8) == 0) { res.sendStatus(401); return; } // Check if we have file rights
1077
1081 - var multiparty = require('multiparty');
1082 - var form = new multiparty.Form();
1078 + const multiparty = require('multiparty');
1079 + const form = new multiparty.Form();
1080 form.parse(req, function (err, fields, files) {
1081 if ((fields == null) || (fields.link == null) || (fields.link.length != 1)) { /*console.log('UploadFile, Invalid Fields:', fields, files);*/ res.sendStatus(404); return; }
1082 var xfile = obj.getServerFilePath(user, domain, decodeURIComponent(fields.link[0]));
@@ -1127,8 +1124,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1124
1125 // Subscribe to all events we are allowed to receive
1126 obj.subscribe = function (userid, target) {
1130 - var user = obj.users[userid];
1131 - var subscriptions = [userid, 'server-global'];
1127 + const user = obj.users[userid];
1128 + const subscriptions = [userid, 'server-global'];
1129 if (user.siteadmin != null) {
1130 if (user.siteadmin == 0xFFFFFFFF) subscriptions.push('*');
1131 if ((user.siteadmin & 2) != 0) subscriptions.push('server-users');
@@ -1221,9 +1218,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1218 };
1219
1220 // TLSSocket to encapsulate TLS communication, which then tunneled via SerialTunnel an then wrapped through CIRA APF
1224 - var TLSSocket = require('tls').TLSSocket;
1225 - var tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
1226 - var tlsock = new TLSSocket(ser, tlsoptions);
1221 + const TLSSocket = require('tls').TLSSocket;
1222 + const tlsoptions = { secureProtocol: ((req.query.tls1only == 1) ? 'TLSv1_method' : 'SSLv23_method'), ciphers: 'RSA+AES:!aNULL:!MD5:!DSS', secureOptions: obj.constants.SSL_OP_NO_SSLv2 | obj.constants.SSL_OP_NO_SSLv3 | obj.constants.SSL_OP_NO_COMPRESSION | obj.constants.SSL_OP_CIPHER_SERVER_PREFERENCE, rejectUnauthorized: false };
1223 + const tlsock = new TLSSocket(ser, tlsoptions);
1224 tlsock.on('error', function (err) { Debug(1, "CIRA TLS Connection Error ", err); });
1225 tlsock.on('secureConnect', function () { Debug(2, "CIRA Secure TLS Connection"); ws._socket.resume(); });
1226
@@ -1397,14 +1394,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1394
1395 // Handle the web socket echo request, just echo back the data sent
1396 function handleEchoWebSocket(ws, req) {
1400 - var domain = checkUserIpAddress(ws, req);
1397 + const domain = checkUserIpAddress(ws, req);
1398 if (domain == null) return;
1399 ws._socket.setKeepAlive(true, 240000); // Set TCP keep alive
1400
1401 // When data is received from the web socket, echo it back
1402 ws.on('message', function (data) {
1406 - var cmd = data.toString('utf8');
1407 - if (cmd == 'close') {
1403 + if (data.toString('utf8') == 'close') {
1404 try { ws.close(); } catch (e) { console.log(e); }
1405 } else {
1406 try { ws.send(data); } catch (e) { console.log(e); }
@@ -1442,7 +1438,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1438 // Handle Intel AMT events
1439 // To subscribe, add "http://server:port/amtevents.ashx" to Intel AMT subscriptions.
1440 obj.handleAmtEventRequest = function (req, res) {
1445 - var domain = getDomain(req);
1441 + const domain = getDomain(req);
1442 try {
1443 if (req.headers.authorization) {
1444 var authstr = req.headers.authorization;
@@ -1518,14 +1514,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1514
1515 // Handle a server backup request
1516 function handleBackupRequest(req, res) {
1521 - var domain = checkUserIpAddress(req, res);
1517 + const domain = checkUserIpAddress(req, res);
1518 if (domain == null) return;
1519 if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (obj.parent.args.noserverbackup == 1)) { res.sendStatus(401); return; }
1520 var user = obj.users[req.session.userid];
1521 if ((user.siteadmin & 1) == 0) { res.sendStatus(401); return; } // Check if we have server backup rights
1522
1523 // Require modules
1528 - const fs = require('fs');
1524 const archive = require('archiver')('zip', { level: 9 }); // Sets the compression method to maximum.
1525
1526 // Good practice to catch this error explicitly
@@ -1542,7 +1537,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1537 for (var i in backupList) {
1538 var filename = backupList[i];
1539 var filepath = obj.path.join(obj.parent.datapath, filename);
1545 - if (fs.existsSync(filepath)) { archive.file(filepath, { name: filename }); }
1540 + if (obj.fs.existsSync(filepath)) { archive.file(filepath, { name: filename }); }
1541 }
1542
1543 // Finalize the archive (ie we are done appending files but streams have to finish yet)
@@ -1551,14 +1546,14 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1546
1547 // Handle a server restore request
1548 function handleRestoreRequest(req, res) {
1554 - var domain = checkUserIpAddress(req, res);
1549 + const domain = checkUserIpAddress(req, res);
1550 if (domain == null) return;
1551 if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid) || (obj.parent.args.noserverbackup == 1)) { res.sendStatus(401); return; }
1557 - var user = obj.users[req.session.userid];
1552 + const user = obj.users[req.session.userid];
1553 if ((user.siteadmin & 4) == 0) { res.sendStatus(401); return; } // Check if we have server restore rights
1554
1560 - var multiparty = require('multiparty');
1561 - var form = new multiparty.Form();
1555 + const multiparty = require('multiparty');
1556 + const form = new multiparty.Form();
1557 form.parse(req, function (err, fields, files) {
1558 res.send('Server must be restarted, <a href="' + domain.url + '">click here to login</a>.');
1559 parent.Stop(files.datafile[0].path);
@@ -1567,7 +1562,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1562
1563 // Handle a request to download a mesh agent
1564 obj.handleMeshAgentRequest = function (req, res) {
1570 - var domain = checkUserIpAddress(req, res);
1565 + const domain = checkUserIpAddress(req, res);
1566 if (domain == null) return;
1567
1568 // If required, check if this user has rights to do this
@@ -1642,7 +1637,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1637 obj.parent.exeHandler.streamExeWithJavaScript({ platform: argentInfo.platform, sourceFileName: argentInfo.path, destinationStream: res, js: Buffer.from(obj.parent.defaultMeshCmd, 'utf8'), peinfo: argentInfo.pe });
1638 }
1639 } else if (req.query.meshaction != null) {
1645 - var domain = checkUserIpAddress(req, res);
1640 + const domain = checkUserIpAddress(req, res);
1641 if (domain == null) { res.sendStatus(404); return; }
1642 var user = obj.users[req.session.userid];
1643 if ((req.query.meshaction == 'route') && (req.query.nodeid != null)) {
@@ -1709,7 +1704,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1704
1705 // Create a OSX mesh agent installer
1706 obj.handleMeshOsxAgentRequest = function (req, res) {
1712 - var domain = checkUserIpAddress(req, res);
1707 + const domain = checkUserIpAddress(req, res);
1708 if ((domain == null) || (req.query.id == null)) { res.sendStatus(404); return; }
1709
1710 // If required, check if this user has rights to do this
@@ -1794,7 +1789,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1789
1790 // Handle a request to download a mesh settings
1791 obj.handleMeshSettingsRequest = function (req, res) {
1797 - var domain = checkUserIpAddress(req, res);
1792 + const domain = checkUserIpAddress(req, res);
1793 if (domain == null) return;
1794 //if ((domain.id !== '') || (!req.session) || (req.session == null) || (!req.session.userid)) { res.sendStatus(401); return; }
1795
@@ -2098,26 +2093,6 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
2093 return obj.path.join(obj.filespath, domainname + "/" + splitname[0] + "-" + splitname[2]);
2094 }
2095
2101 - // Read entire file and return it in callback function
2102 - function readEntireTextFile(filepath, func) {
2103 - var called = false;
2104 - try {
2105 - obj.fs.open(filepath, 'r', function (err, fd) {
2106 - obj.fs.fstat(fd, function (err, stats) {
2107 - var bufferSize = stats.size, chunkSize = 512, buffer = Buffer.alloc(bufferSize), bytesRead = 0;
2108 - while (bytesRead < bufferSize) {
2109 - if ((bytesRead + chunkSize) > bufferSize) { chunkSize = (bufferSize - bytesRead); }
2110 - obj.fs.readSync(fd, buffer, bytesRead, chunkSize, bytesRead);
2111 - bytesRead += chunkSize;
2112 - }
2113 - obj.fs.close(fd);
2114 - called = true;
2115 - func(buffer.toString('utf8', 0, bufferSize));
2116 - });
2117 - });
2118 - } catch (e) { if (called == false) { func(null); } }
2119 - }
2120 -
2096 // Return true is the input string looks like an email address
2097 function checkEmail(str) {
2098 var x = str.split('@');