Fix for #2682

Ylian Saint-Hilaire committed May 25, 2021 at 10:35 UTC fba2ac227ad3a92538bec77a85055710ff08275f
1 file changed +4 -20
apprelays.js
+4 -20
@@ -551,16 +551,8 @@ module.exports.CreateSshTerminalRelay = function (parent, db, ws, req, domain, u
551 // If the web socket is closed
552 ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
553
554 - // Decode the authentication cookie
555 - var userCookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
556 - if ((userCookie == null) || (userCookie.a != null)) { obj.close(); return; } // Invalid cookie
557 -
558 - // Fetch the user
559 - var user = parent.users[userCookie.userid]
560 - if (user == null) { obj.close(); return; } // Invalid userid
561 -
562 - // Check that we have a nodeid
563 - if (req.query.nodeid == null) { obj.close(); return; } // Invalid nodeid
554 + // Check that we have a user and nodeid
555 + if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
556 parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
557 // Check permissions
558 if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights
@@ -988,16 +980,8 @@ module.exports.CreateSshFilesRelay = function (parent, db, ws, req, domain, user
980 // If the web socket is closed
981 ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
982
991 - // Decode the authentication cookie
992 - var userCookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
993 - if ((userCookie == null) || (userCookie.a != null)) { obj.close(); return; } // Invalid cookie
994 -
995 - // Fetch the user
996 - var user = parent.users[userCookie.userid]
997 - if (user == null) { obj.close(); return; } // Invalid userid
998 -
999 - // Check that we have a nodeid
1000 - if (req.query.nodeid == null) { obj.close(); return; } // Invalid nodeid
983 + // Check that we have a user and nodeid
984 + if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
985 parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
986 // Check permissions
987 if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights