Fix for #2682
Ylian Saint-Hilaire committed
May 25, 2021 at 10:35 UTC
fba2ac227ad3a92538bec77a85055710ff08275f
1 file changed
+4
-20
apprelays.js
+4
-20
@@ -551,16 +551,8 @@ module.exports.CreateSshTerminalRelay = function (parent, db, ws, req, domain, u
551
// If the web socket is closed
552
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
553
554
- // Decode the authentication cookie
555
- var userCookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
556
- if ((userCookie == null) || (userCookie.a != null)) { obj.close(); return; } // Invalid cookie
557
-
558
- // Fetch the user
559
- var user = parent.users[userCookie.userid]
560
- if (user == null) { obj.close(); return; } // Invalid userid
561
-
562
- // Check that we have a nodeid
563
- if (req.query.nodeid == null) { obj.close(); return; } // Invalid nodeid
554
+ // Check that we have a user and nodeid
555
+ if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
556
parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
557
// Check permissions
558
if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights
@@ -988,16 +980,8 @@ module.exports.CreateSshFilesRelay = function (parent, db, ws, req, domain, user
980
// If the web socket is closed
981
ws.on('close', function (req) { parent.parent.debug('relay', 'SSH: Browser websocket closed'); obj.close(); });
982
991
- // Decode the authentication cookie
992
- var userCookie = parent.parent.decodeCookie(req.query.auth, parent.parent.loginCookieEncryptionKey);
993
- if ((userCookie == null) || (userCookie.a != null)) { obj.close(); return; } // Invalid cookie
994
-
995
- // Fetch the user
996
- var user = parent.users[userCookie.userid]
997
- if (user == null) { obj.close(); return; } // Invalid userid
998
-
999
- // Check that we have a nodeid
1000
- if (req.query.nodeid == null) { obj.close(); return; } // Invalid nodeid
983
+ // Check that we have a user and nodeid
984
+ if ((user == null) || (req.query.nodeid == null)) { obj.close(); return; } // Invalid nodeid
985
parent.GetNodeWithRights(domain, user, req.query.nodeid, function (node, rights, visible) {
986
// Check permissions
987
if ((rights & 8) == 0) { obj.close(); return; } // No MESHRIGHT_REMOTECONTROL rights