MeshRelay fix for #3118
Ylian Saint-Hilaire committed
Sep 10, 2021 at 12:20 UTC
f918ae537c865b85ae980c54bc24a88641799508
1 file changed
+15
-11
meshrelay.js
+15
-11
@@ -953,17 +953,21 @@ function CreateMeshRelayEx(parent, ws, req, domain, user, cookie) {
953
return obj;
954
} else {
955
// No routing needed. Just check permissions and fill in the device nodeid and meshid.
956
- parent.db.Get(obj.req.query.nodeid, function (err, docs) {
957
- if (docs.length == 0) { console.log('ERR: Node not found'); try { obj.close(); } catch (e) { } return; } // Disconnect websocket
958
- const node = docs[0];
959
-
960
- // Check if this user has permission to manage this computer
961
- if ((parent.GetNodeRights(user, node.meshid, node._id) & MESHRIGHT_REMOTECONTROL) == 0) { console.log('ERR: Access denied (2)'); try { obj.close(); } catch (e) { } return; }
962
-
963
- // Set nodeid and meshid
964
- obj.nodeid = node._id;
965
- obj.meshid = node.meshid;
966
- });
956
+ if ((obj.req.query.nodeid != null) && (obj.req.query.nodeid.startsWith('node/'))) {
957
+ var nodeSplit = obj.req.query.nodeid.split('/');
958
+ if ((nodeSplit.length != 3) || (nodeSplit[1] != domain.id)) { console.log('ERR: Invalid NodeID'); try { obj.close(); } catch (e) { } return; }
959
+ parent.db.Get(obj.req.query.nodeid, function (err, docs) {
960
+ if (docs.length == 0) { console.log('ERR: Node not found'); try { obj.close(); } catch (e) { } return; } // Disconnect websocket
961
+ const node = docs[0];
962
+
963
+ // Check if this user has permission to manage this computer
964
+ if ((parent.GetNodeRights(user, node.meshid, node._id) & MESHRIGHT_REMOTECONTROL) == 0) { console.log('ERR: Access denied (2)'); try { obj.close(); } catch (e) { } return; }
965
+
966
+ // Set nodeid and meshid
967
+ obj.nodeid = node._id;
968
+ obj.meshid = node.meshid;
969
+ });
970
+ }
971
}
972
}
973