My Account
- 
+
+ 
+
+ Account security
@@ -9675,6 +9676,48 @@
meshserver.send({ action: 'previousLogins' });
}
+ function account_manageImage() {
+ if (xxdialogMode) return;
+ var x = '';
+ setDialogMode(2, "Manage Account Image", 7, account_manageImageEx2, x);
+ var ctx = Q('p2canvas').getContext("2d");
+ if ((userinfo.flags != null) && (userinfo.flags & 1)) {
+ var myImg = new Image();
+ myImg.onload = function() { ctx.drawImage(myImg, 0, 0); };
+ myImg.src = 'userimage.ashx';
+ } else {
+ ctx.fillStyle = "#CCC";
+ ctx.fillRect(0, 0, 256, 256);
+ }
+ QE('idx_dlgDeleteButton', (userinfo.flags != null) && (userinfo.flags & 1));
+ QE('idx_dlgOkButton', false);
+ }
+
+ function account_canvasClick() { Q('p2file').click(); }
+
+ function account_manageImageEx() {
+ var file = Q('p2file').files[0];
+ var img = new Image;
+ img.onload = function() {
+ var cx = 0, cy = 0, min = Math.min(img.width, img.height);
+ if (img.width > min) { cx = (img.width - min) / 2; }
+ if (img.height > min) { cy = (img.height - min) / 2; }
+ var ctx = Q('p2canvas').getContext("2d");
+ ctx.imageSmoothingEnabled = true;
+ ctx.webkitImageSmoothingEnabled = true;
+ ctx.mozImageSmoothingEnabled = true;
+ ctx.drawImage(img, cx, cy, min, min, 0, 0, 256, 256);
+ QE('idx_dlgOkButton', true);
+ }
+ img.src = URL.createObjectURL(file);
+ }
+
+ function account_manageImageEx2(b, t) {
+ // Send updated image, or 0 if we pressed the delete button
+ meshserver.send({ action: 'updateUserImage', image: (b == 2)?0:Q('p2canvas').toDataURL('image/jpeg', 0.8) });
+ //meshserver.send({ action: 'updateUserImage', image: (b == 2)?0:Q('p2canvas').toDataURL('image/png', 0.8) });
+ }
+
function account_managePhone() {
if (xxdialogMode || ((features & 0x02000000) == 0)) return;
var x;
diff --git a/webserver.js b/webserver.js
index a323f89f..f7ae0f15 100644
--- a/webserver.js
+++ b/webserver.js
@@ -1871,6 +1871,26 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
}
}
+ // Called to process an agent invite request
+ function handleUserImageRequest(req, res) {
+ const domain = getDomain(req);
+ if (domain == null) { parent.debug('web', 'handleUserImageRequest: failed checks.'); res.sendStatus(404); return; }
+ if ((req.session == null) || (req.session.userid == null)) { parent.debug('web', 'handleUserImageRequest: failed checks 2.'); res.sendStatus(404); return; }
+ obj.db.Get('im' + req.session.userid, function (err, docs) {
+ if ((err != null) || (docs == null) || (docs.length != 1) || (typeof docs[0].image != 'string')) { res.sendStatus(404); return; }
+ var imagebase64 = docs[0].image;
+ if (imagebase64.startsWith('data:image/png;base64,')) {
+ res.set('Content-Type', 'image/png');
+ res.send(Buffer.from(imagebase64.substring(22), 'base64'));
+ } else if (imagebase64.startsWith('data:image/jpeg;base64,')) {
+ res.set('Content-Type', 'image/jpeg');
+ res.send(Buffer.from(imagebase64.substring(23), 'base64'));
+ } else {
+ res.sendStatus(404);
+ }
+ });
+ }
+
function handleDeleteAccountRequest(req, res, direct) {
parent.debug('web', 'handleDeleteAccountRequest()');
const domain = checkUserIpAddress(req, res);
@@ -1948,8 +1968,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
}
}
- // Remove notes for this user
- obj.db.Remove('nt' + deluser._id);
+ obj.db.Remove('ws' + deluser._id); // Remove user web state
+ obj.db.Remove('nt' + deluser._id); // Remove notes for this user
+ obj.db.Remove('im' + deluser._id); // Remove image for this user
// Remove the user
obj.db.Remove(deluser._id);
@@ -5061,8 +5082,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
const headers = {
'Referrer-Policy': 'no-referrer',
'X-XSS-Protection': '1; mode=block',
- 'X-Content-Type-Options': 'nosniff',
- 'Content-Security-Policy': "default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'" + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self' https://*.youtube.com mcrouter:; media-src 'self'; form-action 'self'"
+ 'X-Content-Type-Options': 'nosniff'
+ //'Content-Security-Policy': "default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'" + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self'" + geourl + " data:; style-src 'self' 'unsafe-inline'; frame-src 'self' https://*.youtube.com mcrouter:; media-src 'self'; form-action 'self'"
};
if ((parent.config.settings.allowframing !== true) && (typeof parent.config.settings.allowframing !== 'string')) { headers['X-Frame-Options'] = 'sameorigin'; }
res.set(headers);
@@ -5167,6 +5188,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
obj.app.post(url + 'resetaccount', handleResetAccountRequest);
obj.app.get(url + 'checkmail', handleCheckMailRequest);
obj.app.get(url + 'agentinvite', handleAgentInviteRequest);
+ obj.app.get(url + 'userimage.ashx', handleUserImageRequest);
obj.app.post(url + 'amtevents.ashx', obj.handleAmtEventRequest);
obj.app.get(url + 'meshagents', obj.handleMeshAgentRequest);
obj.app.get(url + 'messenger', handleMessengerRequest);