zefie/minisrv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BREAKING CHANGES: (for SeCuRiTy):

Browse Source 
By default:
- `ssid_sessions[socket.ssid]` is now `session_data`
- `require` is no longer allowed in user scripts

To access global `socket_sessions` and `ssid_sessions`, as well as `require` additional modules, you must set `privileged: true` for the specific service. See `config.json`.
This commit is contained in:
zefie
2022-10-09 13:26:14 -04:00
parent 2491f62b89
commit 37f1ab67ad
118 changed files with 577 additions and 530 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/ValidateLogin.js
View File

@@ -10,17 +10,17 @@ Location: client:gototvhome
wtv-visit: client:hangupphone`
} else {
var user_id = (request_headers.query.user_id) ? request_headers.query.user_id : ssid_sessions[socket.ssid].user_id;
var user_id = (request_headers.query.user_id) ? request_headers.query.user_id : session_data.user_id;
if (socket.ssid !== null && user_id !== null) ssid_sessions[socket.ssid].switchUserID(user_id);
if (socket.ssid !== null && user_id !== null) session_data.switchUserID(user_id);
if (socket.ssid !== null && !ssid_sessions[socket.ssid].get("wtvsec_login")) {
if (socket.ssid !== null && !session_data.get("wtvsec_login")) {
wtvsec_login = new WTVSec(minisrv_config);
wtvsec_login.IssueChallenge();
wtvsec_login.set_incarnation(request_headers["wtv-incarnation"]);
ssid_sessions[socket.ssid].set("wtvsec_login", wtvsec_login);
session_data.set("wtvsec_login", wtvsec_login);
} else {
wtvsec_login = ssid_sessions[socket.ssid].get("wtvsec_login");
wtvsec_login = session_data.get("wtvsec_login");
}
if (socket.ssid !== null) {
@@ -57,8 +57,8 @@ wtv-visit: client:hangupphone`
headers = `403 Please enter your password and try again
minisrv-no-mail-count: true
`;
} else if (ssid_sessions[socket.ssid].validateUserPassword(request_headers.query.password)) {
ssid_sessions[socket.ssid].setUserLoggedIn(true);
} else if (session_data.validateUserPassword(request_headers.query.password)) {
session_data.setUserLoggedIn(true);
headers = `200 OK
minisrv-no-mail-count: true
Content-Type: text/html
@@ -70,14 +70,14 @@ minisrv-no-mail-count: true
`;
}
} else {
if (ssid_sessions[socket.ssid].baddisk === true) {
if (session_data.baddisk === true) {
gourl = "wtv-head-waiter:/bad-disk?"
}
else if (ssid_sessions[socket.ssid].getNumberOfUserAccounts() > 1 && user_id === 0 && request_headers.query.initial_login) {
else if (session_data.getNumberOfUserAccounts() > 1 && user_id === 0 && request_headers.query.initial_login) {
gourl = "wtv-head-waiter:/choose-user?"
} else {
var limitedLogin = (!ssid_sessions[socket.ssid].lockdown && (!ssid_sessions[socket.ssid].get('password_valid') && ssid_sessions[socket.ssid].getUserPasswordEnabled()));
var limitedLoginRegistered = (limitedLogin && ssid_sessions[socket.ssid].isRegistered());
var limitedLogin = (!session_data.lockdown && (!session_data.get('password_valid') && session_data.getUserPasswordEnabled()));
var limitedLoginRegistered = (limitedLogin && session_data.isRegistered());
}
headers = `200 OK
wtv-connection-close: true
@@ -87,7 +87,7 @@ Content-Type: text/html`;
if (client_challenge_response) {
headers += `
wtv-encrypted: true`;
if (wtvsec_login) ssid_sessions[socket.ssid].data_store.wtvsec_login.update_ticket = true;
if (wtvsec_login) session_data.data_store.wtvsec_login.update_ticket = true;
}
if (limitedLoginRegistered) gourl = "wtv-head-waiter:/password?";
headers += `

6
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/bad-disk.js
View File

@@ -1,9 +1,9 @@
var minisrv_service_file = true;
// remove restrictions once this page is shown, since the user will be 'trapped' anyway
ssid_sessions[socket.ssid].disableLockdown();
ssid_sessions[socket.ssid].delete("wtv-my-disk-sucks-sucks-sucks");
ssid_sessions[socket.ssid].baddisk = false;
session_data.disableLockdown();
session_data.delete("wtv-my-disk-sucks-sucks-sucks");
session_data.baddisk = false;
headers = `200 OK
Content-type: text/html`;

4
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/choose-user.js
View File

@@ -1,6 +1,6 @@
var minisrv_service_file = true;
if (socket.ssid !== null) ssid_sessions[socket.ssid].switchUserID(0);
if (socket.ssid !== null) session_data.switchUserID(0);
headers = `200 OK
minisrv-no-mail-count: true
@@ -74,7 +74,7 @@ Choose your name
<tr><td absheight=2>
<tr>`;
var accounts = ssid_sessions[socket.ssid].listPrimaryAccountUsers();
var accounts = session_data.listPrimaryAccountUsers();
var accounts_listed = 0;
for (const [key, value] of Object.entries(accounts)) {
data += "<td absheight=37><td valign=middle abswidth=50% maxlines=1>";

48
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login-stage-two.js
View File

@@ -1,14 +1,14 @@
var minisrv_service_file = true;
var gourl = null;
if (!ssid_sessions[socket.ssid].isRegistered() && (!request_headers.query.guest_login || !minisrv_config.config.allow_guests)) gourl = "wtv-register:/splash?";
if (!session_data.isRegistered() && (!request_headers.query.guest_login || !minisrv_config.config.allow_guests)) gourl = "wtv-register:/splash?";
var home_url = "wtv-home:/home?";
if (gourl) {
headers = `200 OK
wtv-open-isp-disabled: false
`;
if (!ssid_sessions[socket.ssid].isRegistered() && (!request_headers.query.guest_login || !minisrv_config.config.allow_guests)) {
if (!session_data.isRegistered() && (!request_headers.query.guest_login || !minisrv_config.config.allow_guests)) {
headers += `wtv-encrypted: true
${getServiceString('wtv-register')}
${getServiceString('wtv-head-waiter')}
@@ -21,7 +21,7 @@ Content-type: text/html`;
data = '';
}
else {
if (ssid_sessions[socket.ssid].lockdown) {
if (session_data.lockdown) {
home_url = minisrv_config.config.unauthorized_url;
}
else if (request_headers.query.guest_login && minisrv_config.config.allow_guests) {
@@ -33,30 +33,30 @@ else {
var messenger_authorized = 0;
if (request_headers.query.skip_splash) gourl = "wtv-home:/home?";
else gourl = "wtv-home:/splash?";
} else if (!ssid_sessions[socket.ssid].getSessionData("registered")) {
} else if (!session_data.getSessionData("registered")) {
var errpage = wtvshared.doErrorPage(400);
headers = errpage[0];
data = errpage[1];
} else {
var userid = ssid_sessions[socket.ssid].getSessionData("subscriber_userid")
var nickname = ssid_sessions[socket.ssid].getSessionData("subscriber_username");
var human_name = ssid_sessions[socket.ssid].getSessionData("subscriber_name") || nickname;
var messenger_enabled = ssid_sessions[socket.ssid].getSessionData("messenger_enabled") || 0;
var messenger_authorized = ssid_sessions[socket.ssid].getSessionData("messenger_authorized") || 0;
var messenger_email = ssid_sessions[socket.ssid].getSessionData("messenger_email");
var userid = session_data.getSessionData("subscriber_userid")
var nickname = session_data.getSessionData("subscriber_username");
var human_name = session_data.getSessionData("subscriber_name") || nickname;
var messenger_enabled = session_data.getSessionData("messenger_enabled") || 0;
var messenger_authorized = session_data.getSessionData("messenger_authorized") || 0;
var messenger_email = session_data.getSessionData("messenger_email");
var gourl = "wtv-home:/splash?";
}
var limitedLogin = ssid_sessions[socket.ssid].lockdown;
var limitedLoginRegistered = (limitedLogin || (ssid_sessions[socket.ssid].isRegistered() && !ssid_sessions[socket.ssid].isUserLoggedIn()));
var limitedLogin = session_data.lockdown;
var limitedLoginRegistered = (limitedLogin || (session_data.isRegistered() && !session_data.isUserLoggedIn()));
var offline_user_list = null;
if (ssid_sessions[socket.ssid].isRegistered()) {
if (session_data.isRegistered()) {
// check for SMTP Password
if (ssid_sessions[socket.ssid].getSessionData("subscriber_smtp_password") === null) {
ssid_sessions[socket.ssid].setUserSMTPPassword(ssid_sessions[socket.ssid].generatePassword(16));
if (session_data.getSessionData("subscriber_smtp_password") === null) {
session_data.setUserSMTPPassword(session_data.generatePassword(16));
}
if (ssid_sessions[socket.ssid].user_id == 0) {
var accounts = ssid_sessions[socket.ssid].listPrimaryAccountUsers();
var num_accounts = ssid_sessions[socket.ssid].getNumberOfUserAccounts();
if (session_data.user_id == 0) {
var accounts = session_data.listPrimaryAccountUsers();
var num_accounts = session_data.getNumberOfUserAccounts();
var offline_user_list_str = "<user-list>\n";
var i = 0;
Object.keys(accounts).forEach((k) => {
@@ -96,14 +96,14 @@ wtv-ssl-timeout: 240
wtv-login-timeout: 7200
`;
if (!limitedLogin && !limitedLoginRegistered) {
ssid_sessions[socket.ssid].assignMailStore();
session_data.assignMailStore();
headers += getServiceString('all', { "exceptions": ["wtv-register"] });
if (offline_user_list) headers += "wtv-offline-user-list: " + offline_user_list + "\n";
headers += `wtv-messenger-authorized: ${messenger_authorized}
wtv-messenger-enable: ${messenger_enabled}
wtv-messagewatch-checktimeoffset: off
wtv-messenger-server: msnmsgr.escargot.chat
wtv-user-name: ${ssid_sessions[socket.ssid].getSessionData("messenger_email")}
wtv-user-name: ${session_data.getSessionData("messenger_email")}
wtv-messenger-login-url: wtv-passport:/messengerlogin
`;
} else {
@@ -127,9 +127,9 @@ wtv-ssl-log-url: wtv-log:/log
headers += `wtv-bypass-proxy: false
user-id: ${userid}
wtv-human-name: ${human_name}
${ssid_sessions[socket.ssid].setIRCNick(nickname)}
wtv-domain: ${ssid_sessions[socket.ssid].getSessionData("messenger_domain")}
passport-domain: ${ssid_sessions[socket.ssid].getSessionData("messenger_domain")}
${session_data.setIRCNick(nickname)}
wtv-domain: ${session_data.getSessionData("messenger_domain")}
passport-domain: ${session_data.getSessionData("messenger_domain")}
wtv-mail-url: wtv-mail:/listmail
wtv-favorite-url: wtv-favorite:/favorite
wtv-favorites-folders-url: wtv-favorite:/list-folders
@@ -164,7 +164,7 @@ wtv-inactive-timeout: 1440
headers += "\nwtv-home-url: " + home_url;
}
if (ssid_sessions[socket.ssid].get('wtv-need-upgrade') != 'true' && !request_headers.query.reconnect && !limitedLogin && !limitedLoginRegistered)
if (session_data.get('wtv-need-upgrade') != 'true' && !request_headers.query.reconnect && !limitedLogin && !limitedLoginRegistered)
headers += "\nwtv-settings-url: wtv-setup:/get\n";
if (!limitedLogin && !limitedLoginRegistered) {

20
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/login.js
View File

@@ -1,8 +1,8 @@
var minisrv_service_file = true;
ssid_sessions[socket.ssid].setUserLoggedIn(false);
session_data.setUserLoggedIn(false);
var challenge_response, challenge_header = "";
if (socket.ssid !== null) ssid_sessions[socket.ssid].switchUserID(0);
if (socket.ssid !== null) session_data.switchUserID(0);
var gourl = "wtv-head-waiter:/ValidateLogin?initial_login=true&";
if (request_headers.query.relogin) gourl += "relogin=true";
@@ -17,29 +17,29 @@ if (request_headers.query.guest_login) {
var send_to_relogin = true;
if (socket.ssid) {
if (ssid_sessions[socket.ssid]) {
if (session_data) {
if (request_headers["wtv-ticket"]) {
if (ssid_sessions[socket.ssid].data_store.wtvsec_login.ticket_b64 == null) {
if (session_data.data_store.wtvsec_login.ticket_b64 == null) {
if (request_headers["wtv-ticket"].length > 8) {
ssid_sessions[socket.ssid].data_store.wtvsec_login.DecodeTicket(request_headers["wtv-ticket"]);
ssid_sessions[socket.ssid].data_store.wtvsec_login.ticket_b64 = request_headers["wtv-ticket"];
session_data.data_store.wtvsec_login.DecodeTicket(request_headers["wtv-ticket"]);
session_data.data_store.wtvsec_login.ticket_b64 = request_headers["wtv-ticket"];
send_to_relogin = false;
}
}
} else {
if (ssid_sessions[socket.ssid].data_store.wtvsec_login) {
if (session_data.data_store.wtvsec_login) {
var client_challenge_response = request_headers["wtv-challenge-response"] || null;
if (challenge_response && client_challenge_response) {
if (challenge_response.toString(CryptoJS.enc.Base64).substring(0, 85) == client_challenge_response.substring(0, 85)) {
console.log(" * wtv-challenge-response success for " + socket.ssid);
ssid_sessions[socket.ssid].data_store.wtvsec_login.PrepareTicket();
session_data.data_store.wtvsec_login.PrepareTicket();
send_to_relogin = false;
} else {
challenge_header = "wtv-challenge: " + ssid_sessions[socket.ssid].data_store.wtvsec_login.IssueChallenge();
challenge_header = "wtv-challenge: " + session_data.data_store.wtvsec_login.IssueChallenge();
send_to_relogin = false;
}
} else {
challenge_header = "wtv-challenge: " + ssid_sessions[socket.ssid].data_store.wtvsec_login.IssueChallenge();
challenge_header = "wtv-challenge: " + session_data.data_store.wtvsec_login.IssueChallenge();
send_to_relogin = false;
}
}

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/password.js
View File

@@ -37,7 +37,7 @@ text="AA9B4A" link=189cd6 vlink=189cd6 hspace=0 fontsize="large"> <form action=/
<td height=125 valign=center>
<font size=+1 color=42bd52>Password
<img src="ROMCache/Spacer.gif" width=4 height=1> <input type=password size=26 maxlength="${minisrv_config.config.passwords.max_length}" name="password" bgcolor=#444444 text=#ffdd33 cursor=#cc9933 id="password" selected >
<input type=hidden name="user_id" id="user_id" value=${ssid_sessions[socket.ssid].user_id}> <tr> <td>
<input type=hidden name="user_id" id="user_id" value=${session_data.user_id}> <tr> <td>
<td>
<tr>
<td>

2
zefie_wtvp_minisrv/ServiceVault/wtv-head-waiter/relogin.js
View File

@@ -1,5 +1,5 @@
var minisrv_service_file = true;
ssid_sessions[socket.ssid].setUserLoggedIn(false);
session_data.setUserLoggedIn(false);
var gourl = "wtv-1800:/preregister?";
if (request_headers.query.relogin) gourl += "relogin=true";