@frangoteam/fuxa-min 1.2.9 → 1.2.10

package/api/index.js

@@ -24,6 +24,7 @@ var commandApi = require('./command');
 const reports = require('../dist/reports.service');
 const reportsApi = new reports.ReportsApiService();
 const verifyApiOrToken = require('./apikeys/verify-api-or-token');
+const utils = require('../runtime/utils');
 
 const version = '1.0.0';
 
@@ -107,6 +108,9 @@ function init(_server, _runtime) {
                     if (tosend.smtp) {
                         delete tosend.smtp.password;
                     }
+                    if (tosend.daqstore?.credentials) {
+                        delete tosend.daqstore.credentials;
+                    }
                     // res.header("Access-Control-Allow-Origin", "*");
                     // res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
                     res.json(tosend);
@@ -131,8 +135,25 @@ function init(_server, _runtime) {
                         if (req.body.smtp && !req.body.smtp.password && runtime.settings.smtp && runtime.settings.smtp.password) {
                             req.body.smtp.password = runtime.settings.smtp.password;
                         }
+                        if (utils.isEmptyObject(req.body.daqstore?.credentials) && runtime.settings.daqstore?.credentials) {
+                            req.body.daqstore.credentials = runtime.settings.daqstore?.credentials;
+                        }
+                        if (!req.body.secretCode && runtime.settings.secretCode) {
+                            req.body.secretCode = runtime.settings.secretCode;
+                        }
+                        const prevAuth = {
+                            secureEnabled: runtime.settings.secureEnabled,
+                            tokenExpiresIn: runtime.settings.tokenExpiresIn,
+                            secretCode: runtime.settings.secretCode
+                        };
                         fs.writeFileSync(runtime.settings.userSettingsFile, JSON.stringify(req.body, null, 4));
                         mergeUserSettings(req.body);
+                        if (prevAuth.secureEnabled !== runtime.settings.secureEnabled ||
+                            prevAuth.tokenExpiresIn !== runtime.settings.tokenExpiresIn ||
+                            prevAuth.secretCode !== runtime.settings.secretCode) {
+                            authJwt.init(runtime.settings.secureEnabled, runtime.settings.secretCode, runtime.settings.tokenExpiresIn);
+                            authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn);
+                        }
                         runtime.restart(true).then(function(result) {
                             res.end();
                         });
@@ -151,24 +172,31 @@ function init(_server, _runtime) {
                     res.end();
                 } else if (res.statusCode === 403) {
                     runtime.logger.error("api post heartbeat: Tocken Expired");
-                } else if (req.body.params) {
-                    const token = authJwt.getNewToken(req.headers)
-                    if (token) {
-                        res.status(200).json({
-                            message: 'tokenRefresh',
-                            token: token
+                }
+                if (req.body.params) {
+
+                    if (!req.isAuthenticated) {
+                        // guest → NON puo rinnovare token
+                        return res.status(200).json({
+                            message: 'guest'
                         });
-                    } else {
-                        res.end();
                     }
-                } else if (req.userId === 'guest') {
-                    res.status(200).json({
+
+                    const token = authJwt.getNewTokenFromRequest(req);
+                    return res.status(200).json({
+                        message: 'tokenRefresh',
+                        token
+                    });
+                }
+
+                // Guest heartbeat
+                if (req.userId === 'guest') {
+                    return res.status(200).json({
                         message: 'guest',
                         token: authJwt.getGuestToken()
                     });
-                } else {
-                    res.end();
                 }
+                return res.end();
             });
 
             runtime.logger.info('api: init successful!', true);
@@ -188,6 +216,9 @@ function mergeUserSettings(settings) {
     runtime.settings.userRole = settings.userRole;
     runtime.settings.nodeRedEnabled = settings.nodeRedEnabled;
     runtime.settings.swaggerEnabled = settings.swaggerEnabled;
+    if (settings.secretCode) {
+        runtime.settings.secretCode = settings.secretCode;
+    }
     if (settings.secureEnabled) {
         runtime.settings.tokenExpiresIn = settings.tokenExpiresIn;
     }

package/api/jwt-helper.js

@@ -53,26 +53,19 @@ function verifyToken (req, res, next) {
             if (err) {
                 req.userId = "guest";
                 req.userGroups = ["guest"];
-            } else {
-                req.userId = decoded.id;
-                req.userGroups = decoded.groups;
-                if (req.headers['x-auth-user']) {
-                    let user = JSON.parse(req.headers['x-auth-user']);
-                    if (user && user.groups != req.userGroups) {
-                        res.status(403).json({ error: "unauthorized_error", message: "User Profile Corrupted!" });
-                    }
-                }
+                req.isAuthenticated = false;
+                return next();
             }
-            next();
+            req.userId = decoded.id;
+            req.userGroups = decoded.groups;
+            req.isAuthenticated = true;
+            return next();
         });
     } else {
         // notice that no token was provided...}
         req.userId = null;
         req.userGroups = null;
-        // if (secureEnabled) {
-        //     res.status(401).json({ error: "unauthorized_error", message: "Token missing!" });
-        // }
-        next();
+        return next();
     }
 }
 
@@ -110,29 +103,22 @@ function requireAuth (req, res, next) {
         } else {
             req.userId = decoded.id;
             req.userGroups = decoded.groups;
-            if (req.headers['x-auth-user']) {
-                let user = JSON.parse(req.headers['x-auth-user']);
-                if (user && user.groups != req.userGroups) {
-                    return res.status(403).json({ error: "unauthorized_error", message: "User Profile Corrupted!" });
-                }
-            }
             next();
         }
     });
 }
 
-function getNewToken(headers) {
-    const authUser = (headers['x-auth-user']) ? JSON.parse(headers['x-auth-user']) : null;
-    if (authUser) {
-        return jwt.sign({
-            id: authUser.user,
-            groups: authUser.groups
-        },
-        secretCode, {
-            expiresIn: tokenExpiresIn
-        });
+function getNewTokenFromRequest(req) {
+    if (!req.isAuthenticated) {
+        return null;
     }
-    return null;
+
+    return jwt.sign({
+        id: req.userId,
+        groups: req.userGroups
+    }, secretCode, {
+        expiresIn: tokenExpiresIn
+    });
 }
 
 function getGuestToken() {
@@ -165,7 +151,7 @@ module.exports = {
     verify: verify,
     verifyToken: verifyToken,
     requireAuth: requireAuth,
-    getNewToken: getNewToken,
+    getNewTokenFromRequest: getNewTokenFromRequest,
     getGuestToken: getGuestToken,
     get secretCode() { return secretCode },
     get tokenExpiresIn() { return tokenExpiresIn },

package/api/projects/index.js

@@ -190,7 +190,16 @@ module.exports = {
          * POST Upload file resource
          * images will be in media file saved
          */
-        prjApp.post('/api/upload', function (req, res) {
+        prjApp.post('/api/upload', secureFnc, function (req, res) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api get device: Tocken Expired");
+                return;
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api get device: Unauthorized");
+                return;
+            }
             const file = req.body.resource;
             const destination = req.body.destination;
             try {
@@ -209,10 +218,21 @@ module.exports = {
                 }
                 let filePath = path.join(runtime.settings.uploadFileDir, fullPath || fileName);
                 if (destination) {
-                    let destinationDir = path.resolve(runtime.settings.appDir, `_${destination}`);
-                    if (process.versions.electron) {
-                        const userDataDir = process.env.userDir || path.join(os.homedir(), '.fuxa');
-                        destinationDir = path.join(userDataDir, `_${destination}`);
+                    const baseDir = process.versions.electron
+                        ? (process.env.userDir || path.join(os.homedir(), '.fuxa'))
+                        : runtime.settings.appDir;
+                    const normalizedDestination = path.normalize(destination).replace(/^([/\\])+/, '');
+                    const destinationParts = normalizedDestination.split(path.sep);
+                    const hasTraversal = destinationParts.includes('..');
+                    if (!normalizedDestination || hasTraversal || path.isAbsolute(destination)) {
+                        res.status(400).json({error:"invalid_destination", message: "Invalid destination path."});
+                        return;
+                    }
+                    const destinationDir = path.resolve(baseDir, `_${normalizedDestination}`);
+                    const resolvedBase = path.resolve(baseDir);
+                    if (destinationDir !== resolvedBase && !destinationDir.startsWith(resolvedBase + path.sep)) {
+                        res.status(400).json({error:"invalid_destination", message: "Invalid destination path."});
+                        return;
                     }
                     filePath = path.join(destinationDir, fullPath || fileName);
                     const dir = path.dirname(filePath);
@@ -236,4 +256,4 @@ module.exports = {
 
         return prjApp;
     }
-}
+}

package/dist/assets/i18n/en.json

@@ -1796,6 +1796,7 @@
     "dlg.app-settings-logs": "Logs",
     "dlg.app-settings-auth-token": "Authentication with Token",
     "dlg.app-settings-auth-only-editor": "Only for Editor",
+    "dlg.app-settings-auth-secret": "Secret code",
     "dlg.app-auth-disabled": "Disabled",
     "dlg.app-auth-expiration-15m": "Enabled with token expiration in 15 min.",
     "dlg.app-auth-expiration-1h": "Enabled with token expiration in 1 hour.",
@@ -1896,7 +1897,8 @@
     "msg.project-save-error": "Project save failed!",
     "msg.project-format-error": "Project wrong format!",
     "msg.view-format-error": "View wrong format!",
-    "msg.project-save-unauthorized": "Project save failed! Unauthorized!",
+    "msg.project-save-unauthorized": "Project save failed! Unauthorized! Reload the page and try again.",
+    "msg.settings-save-unauthorized": "Settings save failed! Unauthorized! Reload the page and try again.",
     "msg.project-save-ask": "Do you want to leave the project?",
     "msg.login-username-required": "Enter a username",
     "msg.login-password-required": "Enter a password",
@@ -1922,5 +1924,6 @@
     "msg.maps-location-name-exist": "The Maps Location name already exists!",
     "msg.text-name-exist": "Text name already exists!",
     "msg.texts-text-remove": "Would you like to remove Text '{{value}}'?",
-    "msg.operation-unauthorized": "Operation Unauthorized!"
+    "msg.operation-unauthorized": "Operation Unauthorized!",
+    "msg.secret-code-required": "Secret code required to sign authentication tokens"
 }

package/dist/index.html

@@ -86,6 +86,6 @@
             </div>
         </div>
     </app-root>
-<script src="runtime.8ef63094e52a66ba.js" type="module"></script><script src="polyfills.c8e7db9850a3ad8b.js" type="module"></script><script src="scripts.40b60f02658462e4.js" defer></script><script src="main.237cd89f3ebaec9c.js" type="module"></script></body>
+<script src="runtime.8ef63094e52a66ba.js" type="module"></script><script src="polyfills.c8e7db9850a3ad8b.js" type="module"></script><script src="scripts.40b60f02658462e4.js" defer></script><script src="main.020ca34630a3363a.js" type="module"></script></body>
 
 </html>