From 2a526c0702c1a9fad25c0b8b37e9ece651b97667 Mon Sep 17 00:00:00 2001 From: zefie Date: Wed, 16 Feb 2022 18:30:19 -0500 Subject: [PATCH] initial attempt to fix security issue - likely adds new bug where users will be kicked to relogin after the server restarts - TODO: figure out a way to safely check the user login when session data is unknown (eg restart) (hint: ticket?) --- .../wtv-head-waiter/login-stage-two.js | 8 +++----- .../ServiceVault/wtv-head-waiter/password.js | 2 +- zefie_wtvp_minisrv/SharedROMCache/NameStrip.gif | Bin 0 -> 117 bytes zefie_wtvp_minisrv/WTVClientSessionData.js | 5 ++++- zefie_wtvp_minisrv/app.js | 12 ++++++++++++ 5 files changed, 20 insertions(+), 7 deletions(-) create mode 100644 zefie_wtvp_minisrv/SharedROMCache/NameStrip.gif diff --git a/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js b/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js index c01fb897..6a52b1dc 100644 --- a/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js +++ b/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js @@ -45,11 +45,10 @@ else { var home_url = "wtv-home:/splash?"; } var limitedLogin = ssid_sessions[socket.ssid].lockdown; - var limitedLoginRegistered = (limitedLogin || (ssid_sessions[socket.ssid].isRegistered() && ssid_sessions[socket.ssid].getSessionData('password_valid'))); + var limitedLoginRegistered = (limitedLogin || (ssid_sessions[socket.ssid].isRegistered() && !ssid_sessions[socket.ssid].getSessionData('password_valid'))); var offline_user_list = null; if (ssid_sessions[socket.ssid].isRegistered() && ssid_sessions[socket.ssid].user_id == 0) { var accounts = ssid_sessions[socket.ssid].listPrimaryAccountUsers(); - console.log(accounts); var num_accounts = ssid_sessions[socket.ssid].getNumberOfUserAccounts(); var offline_user_list_str = "\n"; var i = 0; @@ -143,9 +142,8 @@ wtv-inactive-timeout: 1440 if (request_headers.query.guest_login) headers += "&guest_login=true"; headers += "\nwtv-boot-url: wtv-head-waiter:/relogin?relogin=true"; - if (request_headers.query.guest_login) headers += "&guest_login=true"; - - headers += "\nwtv-home-url: wtv-home:/home?"; + if (request_headers.query.guest_login) headers += "&guest_login=true"; + headers += "\nwtv-home-url: " + home_url; } if (ssid_sessions[socket.ssid].get('wtv-need-upgrade') != 'true' && !request_headers.query.reconnect && !limitedLogin) diff --git a/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/password.js b/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/password.js index 4dc80581..237cfaf8 100644 --- a/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/password.js +++ b/zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/password.js @@ -18,7 +18,7 @@ data = `Password -}TL%Sj52a|NnmjGha~&C1GJ<9v&WUZf*uJ&;gMkH4My761(pFGdShB zdT&H$(1{ZX8huZ8l*X@Im*YKmp7!}I9Lr1By_XXId_du~nvRs?k;O%vo<{S1)JvkK Q1g*E$F0