zefie/minisrv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add protection against requesting direct service files

Browse Source
This commit is contained in:
zefie
2021-08-15 18:51:48 -04:00
parent daf6ec9339
commit 1967c076a9
48 changed files with 215 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zefie_wtvp_minisrv/ServiceVault/http_pc/get.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (request_headers.query.url) {
if (request_headers.query.url.indexOf(":/") > 0) {
var service_request = request_headers.query.url.split(":/")[0];

2
zefie_wtvp_minisrv/ServiceVault/http_pc/index.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`

2
zefie_wtvp_minisrv/ServiceVault/wtv-1800/noflash.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (socket.ssid != null && !ssid_sessions[socket.ssid].get("wtvsec_login")) {
var wtvsec_login = new WTVSec(minisrv_config);
wtvsec_login.IssueChallenge();

2
zefie_wtvp_minisrv/ServiceVault/wtv-1800/offer-open-isp-suggest.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var gourl = "wtv-1800:/finish-prereg?";
if (request_headers.query.relogin) gourl += "relogin=true";

76
zefie_wtvp_minisrv/ServiceVault/wtv-1800/preregister.js
View File

@@ -1,45 +1,47 @@
var gourl = "wtv-head-waiter:/login?";
var minisrv_service_file = true;
if (socket.ssid) {
if (ssid_sessions[socket.ssid].loadSessionData() == true) {
console.log(" * Loaded session data from disk for", wtvshared.filterSSID(socket.ssid))
ssid_sessions[socket.ssid].setSessionData("registered", (ssid_sessions[socket.ssid].getSessionData("registered") == true) ? true : false);
} else {
ssid_sessions[socket.ssid].session_data = {};
ssid_sessions[socket.ssid].setSessionData("registered", false);
}
if (ssid_sessions[socket.ssid].data_store) {
if (ssid_sessions[socket.ssid].data_store.sockets) {
var i = 0;
ssid_sessions[socket.ssid].data_store.sockets.forEach(function (k) {
if (typeof k != "undefined") {
if (k != socket) {
k.destroy();
ssid_sessions[socket.ssid].data_store.sockets.delete(k);
i++;
}
}
});
if (i > 0 && minisrv_config.config.debug_flags.debug) console.log(" # Closed", i, "previous sockets for", wtvshared.filterSSID(socket.ssid));
}
}
if (ssid_sessions[socket.ssid].data_store.wtvsec_login) {
if (minisrv_config.config.debug_flags.debug) console.log(" # Recreating primary WTVSec login instance for", wtvshared.filterSSID(socket.ssid));
delete ssid_sessions[socket.ssid].data_store.wtvsec_login;
}
var gourl = "wtv-head-waiter:/login?";
ssid_sessions[socket.ssid].data_store.wtvsec_login = new WTVSec(minisrv_config);
ssid_sessions[socket.ssid].data_store.wtvsec_login.IssueChallenge();
ssid_sessions[socket.ssid].data_store.wtvsec_login.set_incarnation(request_headers["wtv-incarnation"] || 1);
if (socket.ssid) {
if (ssid_sessions[socket.ssid].loadSessionData() == true) {
console.log(" * Loaded session data from disk for", wtvshared.filterSSID(socket.ssid))
ssid_sessions[socket.ssid].setSessionData("registered", (ssid_sessions[socket.ssid].getSessionData("registered") == true) ? true : false);
} else {
console.log(" * Something bad happened (we don't know the client ssid???)");
var errpage = doErrorPage(400)
headers = errpage[0];
data = errpage[1];
ssid_sessions[socket.ssid].session_data = {};
ssid_sessions[socket.ssid].setSessionData("registered", false);
}
if (ssid_sessions[socket.ssid].data_store) {
if (ssid_sessions[socket.ssid].data_store.sockets) {
var i = 0;
ssid_sessions[socket.ssid].data_store.sockets.forEach(function (k) {
if (typeof k != "undefined") {
if (k != socket) {
k.destroy();
ssid_sessions[socket.ssid].data_store.sockets.delete(k);
i++;
}
}
});
if (i > 0 && minisrv_config.config.debug_flags.debug) console.log(" # Closed", i, "previous sockets for", wtvshared.filterSSID(socket.ssid));
}
}
if (ssid_sessions[socket.ssid].data_store.wtvsec_login) {
if (minisrv_config.config.debug_flags.debug) console.log(" # Recreating primary WTVSec login instance for", wtvshared.filterSSID(socket.ssid));
delete ssid_sessions[socket.ssid].data_store.wtvsec_login;
}
if (request_headers.query.relogin && ssid_sessions[socket.ssid].getSessionData("registered")) gourl += "relogin=true";
if (request_headers.query.reconnect && ssid_sessions[socket.ssid].getSessionData("registered")) gourl += "reconnect=true";
ssid_sessions[socket.ssid].data_store.wtvsec_login = new WTVSec(minisrv_config);
ssid_sessions[socket.ssid].data_store.wtvsec_login.IssueChallenge();
ssid_sessions[socket.ssid].data_store.wtvsec_login.set_incarnation(request_headers["wtv-incarnation"] || 1);
} else {
console.log(" * Something bad happened (we don't know the client ssid???)");
var errpage = doErrorPage(400)
headers = errpage[0];
data = errpage[1];
}
if (request_headers.query.relogin && ssid_sessions[socket.ssid].getSessionData("registered")) gourl += "relogin=true";
if (request_headers.query.reconnect && ssid_sessions[socket.ssid].getSessionData("registered")) gourl += "reconnect=true";
if (ssid_sessions[socket.ssid].data_store.wtvsec_login) {
var prereg_contype = "text/html";

2
zefie_wtvp_minisrv/ServiceVault/wtv-chat/MakeChatPage.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = "200 OK";
if (request_headers.query.nick) headers += "\n" + ssid_sessions[socket.ssid].setIRCNick(request_headers.query.nick);
headers += "\nContent-Type: text/html";

2
zefie_wtvp_minisrv/ServiceVault/wtv-chat/home.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var irc_nick = "";
headers = "200 OK";
if (request_headers.query.nick) headers += "\n" + ssid_sessions[socket.ssid].setIRCNick(request_headers.query.nick);

2
zefie_wtvp_minisrv/ServiceVault/wtv-cookie/add.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (socket.ssid) {
if (request_headers.post_data) {
if (ssid_sessions[socket.ssid]) {

2
zefie_wtvp_minisrv/ServiceVault/wtv-cookie/get.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (request_headers.post_data) {
if (request_headers.query.domain && request_headers.query.path) {
if (socket.ssid) {

2
zefie_wtvp_minisrv/ServiceVault/wtv-cookie/list.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (socket.ssid) {
if (ssid_sessions[socket.ssid]) {

2
zefie_wtvp_minisrv/ServiceVault/wtv-cookie/reset.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (socket.ssid) {
if (ssid_sessions[socket.ssid]) {
ssid_sessions[socket.ssid].resetCookies();

2
zefie_wtvp_minisrv/ServiceVault/wtv-disk/delete-group.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (request_headers.query.group) {
const WTVDownloadList = require("./WTVDownloadList.js");
var wtvdl = new WTVDownloadList(minisrv_config, service_name);

2
zefie_wtvp_minisrv/ServiceVault/wtv-disk/sync.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
const WTVDownloadList = require("./WTVDownloadList.js");
var wtvdl = new WTVDownloadList(minisrv_config, service_name);

2
zefie_wtvp_minisrv/ServiceVault/wtv-disk/userstore.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (request_headers.post_data) {
if (request_headers.query.partialPath || request_headers.query.path) {
if (socket.ssid) {

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/content/content-serve.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
const WTVFlashrom = require("./WTVFlashrom.js");
request_is_async = true;

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/current-noflash.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
const WTVFlashrom = require("./WTVFlashrom.js");
request_is_async = true;

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/get-by-path.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
const WTVFlashrom = require("./WTVFlashrom.js");
request_is_async = true;

4
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/get-lc2-page.js
View File

@@ -93,7 +93,9 @@ data += `
nexturl="${flashrom_info.next_rompath}"
errorurl="${service_name}:/lc2-download-failed?"
`
if (!flashrom_info.is_last_part) data += `blockurl = "${flashrom_info.rompath}"`;
if (!var minisrv_service_file = true;
flashrom_info.is_last_part) data += `blockurl = "${flashrom_info.rompath}"`;
data += `
lastblock="${flashrom_info.is_last_part}"

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/initiate-lc2-download.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (request_headers.query.path) {
var url = service_name + ":/get-lc2-page?path=" + request_headers.query.path;
var romtype = ssid_sessions[socket.ssid].get("wtv-client-rom-type");

4
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/lc2-download-complete.js
View File

@@ -42,7 +42,9 @@ Updating complete
<td colspan=12 width=560 height=10 valign=top align=left>
<img src="${service_name}:/ROMCache/S40H1.gif" width=560 height=6>
<tr>
<td width=104 height=10 valign=top align=left>
<td width=104 height=10 valign=top align=left>var minisrv_service_file = true;
<td width=20 valign=top align=left>
<td width=67 valign=top align=left>
<td width=20 valign=top align=left>

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/lc2-download-failed.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var error = '';
if (request_headers.query.error) {
switch (request_headers.query.error) {

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/noflash.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
const WTVFlashrom = require("./WTVFlashrom.js");
request_is_async = true;

2
zefie_wtvp_minisrv/ServiceVault/wtv-flashrom/willie.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
// willie is just a graphical frontend to a list of ROMs
// the rest of the scripts should work if you manually link to a ROM, and actually have it.

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/finalize-security.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var challenge_response, challenge_header = '';
var gourl;

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var challenge_response, challenge_header = '';
var gourl;

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var challenge_response, challenge_header = "";
var gourl = "wtv-head-waiter:/login-stage-two?";

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/relogin.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
var gourl = "wtv-1800:/preregister?";
if (request_headers.query.relogin) gourl += "relogin=true";
else if (request_headers.query.reconnect) gourl += "reconnect=true";

2
zefie_wtvp_minisrv/ServiceVault/wtv-home/home.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers =`200 OK
Connection: Keep-Alive
wtv-expire-all: wtv-home:/splash

2
zefie_wtvp_minisrv/ServiceVault/wtv-home/splash.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Connection: Keep-Alive
wtv-expire-all: wtv-

2
zefie_wtvp_minisrv/ServiceVault/wtv-log/log.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
// write posted log data to disk. should be decrypted by this point (if it was encrypted) if the crypto stream didn't break
request_is_async = true;

2
zefie_wtvp_minisrv/ServiceVault/wtv-music/get-playlist.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`;

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/BeMyGuest.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (minisrv_config.config.allow_guests) {
headers = `300 Moved
Connection: Close

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/FinishRegistration.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `300 Moved
Connection: Close
wtv-noback-all: wtv-register:

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/ValidateAccountInfo.js
View File

@@ -1,4 +1,4 @@
var minisrv_service_file = true;
if (!request_headers.query.registering) {
var errpage = doErrorPage(400);

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/ValidateAgreement.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (!request_headers.query.registering) {
var errpage = doErrorPage(400);
headers = errpage[0];

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/ValidateReviewAccountInfo.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
if (!request_headers.query.registering ||
!request_headers.query.subscriber_name ||
!request_headers.query.subscriber_username ||

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/register.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`;

2
zefie_wtvp_minisrv/ServiceVault/wtv-register/splash.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Connection: Keep-Alive
wtv-expire-all: wtv-

2
zefie_wtvp_minisrv/ServiceVault/wtv-setup/get.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
wtv-backgroundmusic-load-playlist: wtv-music:/get-playlist
wtv-printer-model: -1,-1

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/access.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
// Allow URL access outside our trusted minisrv
if (request_headers.query.url) var url = request_headers.query.url;

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/blastbacklist.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
wtv-expire-all: wtv-
wtv-expire-all: http

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/go-offline.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
wtv-noback-all: wtv-
wtv-expire-all: wtv-

1
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/info.js
View File

@@ -1,3 +1,4 @@
var minisrv_service_file = true;
var client_caps = null;

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/register.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`;

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/tricks.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`

2
zefie_wtvp_minisrv/ServiceVault/wtv-tricks/unregister.js
View File

@@ -1,3 +1,5 @@
var minisrv_service_file = true;
headers = `200 OK
Content-Type: text/html`;