✓
✗
@@ -285,7 +285,6 @@
var domain = '{{{domain}}}';
var domainUrl = '{{{domainurl}}}';
var authCookie = '{{{authCookie}}}';
- var nodeid = '{{{nodeid}}}';
var viewOnly = parseInt('{{{viewOnly}}}');
var urlargs = parseUriArgs();
var debugmode = urlargs.debug;
@@ -300,6 +299,7 @@
QH('p12power', printFlexDateTime(new Date(parseInt(expire))));
QH('p13power', printFlexDateTime(new Date(parseInt(expire))));
}
+ var features = parseInt('{{{features}}}');
// Terminal
var terminal = null;
@@ -341,7 +341,24 @@
Q('p13filetable').addEventListener('dragover', p13fileDragOver, false);
Q('p13filetable').addEventListener('dragleave', p13fileDragLeave, false);
- go(11); // Go to desktop
+ // Setup feature visibility
+ QV('LeftMenuDesktop', features & 2);
+ QV('LeftMenuTerminal', features & 1);
+ QV('LeftMenuFiles', features & 4);
+ if (features & 2) { go(11); } // Goto desktop
+ else if (features & 1) { go(12); } // Goto terminal
+ else if (features & 4) { go(13); } // Goto files
+
+ // Only show left bar if two or more features are visible
+ var featureCount = 0;
+ if (features & 1) { featureCount++; }
+ if (features & 2) { featureCount++; }
+ if (features & 4) { featureCount++; }
+ QV('LeftSideToolBar', featureCount > 1);
+ QS('p11')['left'] = (featureCount > 1) ? '54px' : '0px';
+ QS('p12')['left'] = (featureCount > 1) ? '54px' : '0px';
+ QS('p13')['left'] = (featureCount > 1) ? '54px' : '0px';
+
deskAdjust();
}
@@ -1717,7 +1734,7 @@
//link = '
' + shortname + '';
// Server link
//link = '
' + shortname + '';
- link = '
' + shortname + '';
+ link = '
' + shortname + '';
}
h = '
';
}
diff --git a/webserver.js b/webserver.js
index fde6d96e..12694603 100644
--- a/webserver.js
+++ b/webserver.js
@@ -2992,7 +2992,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
function handleDeviceFile(req, res) {
const domain = checkUserIpAddress(req, res);
if (domain == null) { return; }
- if ((req.query.c == null) || (req.query.n == null) || (req.query.f == null)) { res.sendStatus(404); return; }
+ if ((req.query.c == null) || (req.query.f == null)) { res.sendStatus(404); return; }
// Check the inbound desktop sharing cookie
var c = obj.parent.decodeCookie(req.query.c, obj.parent.loginCookieEncryptionKey, 60); // 60 minute timeout
@@ -3002,6 +3002,12 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
const user = obj.users[c.userid];
if ((c == user)) { res.sendStatus(404); return; }
+ // If this cookie has restricted usages, check that it's allowed to perform downloads
+ if (Array.isArray(c.usages) && (c.usages.indexOf(10) < 0)) { res.sendStatus(404); return; } // Check protocol #10
+
+ if (c.nid != null) { req.query.n = c.nid.split('/')[2]; } // This cookie is restricted to a specific nodeid.
+ if (req.query.n == null) { res.sendStatus(404); return; }
+
// Check if this user has permission to manage this computer
obj.GetNodeWithRights(domain, user, 'node/' + domain.id + '/' + req.query.n, function (node, rights, visible) {
if ((node == null) || ((rights & MESHRIGHT_REMOTECONTROL) == 0) || (visible == false)) { res.sendStatus(404); return; } // We don't have remote control rights to this device
@@ -3310,7 +3316,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
// Check the inbound desktop sharing cookie
var c = obj.parent.decodeCookie(req.query.c, obj.parent.invitationLinkEncryptionKey, 60); // 60 minute timeout
- if ((c == null) || (c.a !== 5) || ((c.p !== 2) && (c.p != null)) || (typeof c.uid != 'string') || (typeof c.nid != 'string') || (typeof c.gn != 'string') || (typeof c.cf != 'number') || (typeof c.start != 'number') || (typeof c.expire != 'number') || (typeof c.pid != 'string')) { res.sendStatus(404); return; }
+ if ((c == null) || (c.a !== 5) || (typeof c.p !== 'number') || (c.p < 1) || (c.p > 7) || (typeof c.uid != 'string') || (typeof c.nid != 'string') || (typeof c.gn != 'string') || (typeof c.cf != 'number') || (typeof c.start != 'number') || (typeof c.expire != 'number') || (typeof c.pid != 'string')) { res.sendStatus(404); return; }
// Check the expired time, expire message.
if (c.expire <= Date.now()) { render(req, res, getRenderPage((domain.sitestyle == 2) ? 'message2' : 'message', req, domain), getRenderArgs({ titleid: 2, msgid: 12, domainurl: encodeURIComponent(domain.url).replace(/'/g, '%27') }, req, domain)); return; }
@@ -3335,13 +3341,13 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
// Looks good, let's create the outbound session cookies.
// Consent flags are 1 = Notify, 8 = Prompt, 64 = Privacy Bar.
- const authCookie = obj.parent.encodeCookie({ userid: c.uid, domainid: domain.id, nid: c.nid, ip: req.clientIp, p: 2, gn: c.gn, cf: 65 | c.cf, r: 8, expire: c.expire, pid: c.pid, vo: c.vo }, obj.parent.loginCookieEncryptionKey);
+ const authCookie = obj.parent.encodeCookie({ userid: c.uid, domainid: domain.id, nid: c.nid, ip: req.clientIp, p: c.p, gn: c.gn, cf: c.cf, r: 8, expire: c.expire, pid: c.pid, vo: c.vo }, obj.parent.loginCookieEncryptionKey);
// Lets respond by sending out the desktop viewer.
var httpsPort = ((obj.args.aliasport == null) ? obj.args.port : obj.args.aliasport); // Use HTTPS alias port is specified
parent.debug('web', 'handleDesktopRequest: Sending guest sharing page for \"' + c.uid + '\", guest \"' + c.gn + '\".');
res.set({ 'Cache-Control': 'no-store' });
- render(req, res, getRenderPage('sharing', req, domain), getRenderArgs({ authCookie: authCookie, authRelayCookie: '', domainurl: encodeURIComponent(domain.url).replace(/'/g, '%27'), nodeid: c.nid, serverDnsName: obj.getWebServerName(domain), serverRedirPort: args.redirport, serverPublicPort: httpsPort, expire: c.expire, viewOnly: (c.vo == 1) ? 1 : 0, nodeName: encodeURIComponent(node.name) }, req, domain));
+ render(req, res, getRenderPage('sharing', req, domain), getRenderArgs({ authCookie: authCookie, authRelayCookie: '', domainurl: encodeURIComponent(domain.url).replace(/'/g, '%27'), nodeid: c.nid, serverDnsName: obj.getWebServerName(domain), serverRedirPort: args.redirport, serverPublicPort: httpsPort, expire: c.expire, viewOnly: (c.vo == 1) ? 1 : 0, nodeName: encodeURIComponent(node.name), features: c.p }, req, domain));
});
});
}
