nodebb-plugin-session-sharing 8.0.0 → 8.0.2

package/library.js

@@ -93,19 +93,27 @@ plugin.appendConfig = async (config) => {
 SocketPlugins.sessionSharing = {};
 
 SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
-	// Retrieve the hash and find matches
-	const { uids } = data;
-
-	if (!uids.length) {
-		throw new Error('no-uids-supplied');
+	if (!socket.uid || !data || !Array.isArray(data.uids)) {
+		throw new Error('[[error:invalid-data]]');
+	}
+	const isAdmin = await user.isAdministrator(socket.uid);
+	if (!isAdmin) {
+		throw new Error('[[error:no-privileges]]');
 	}
 
 	return Promise.all(
-		uids.map(async uid => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid))
+		data.uids.map(uid => db.getSortedSetRangeByScore(`${plugin.settings.name}:uid`, 0, -1, uid, uid))
 	);
 };
 
 SocketPlugins.sessionSharing.findUserByRemoteId = async (socket, data) => {
+	if (!socket.uid || !data || !Array.isArray(data.uids)) {
+		throw new Error('[[error:invalid-data]]');
+	}
+	const isAdmin = await user.isAdministrator(socket.uid);
+	if (!isAdmin) {
+		throw new Error('[[error:no-privileges]]');
+	}
 	if (!data.remoteId) {
 		throw new Error('no-remote-id-supplied');
 	}
@@ -359,11 +367,19 @@ async function executeJoinLeave(uid, join, leave) {
 }
 
 plugin.createUser = async (userData) => {
-	winston.verbose('[session-sharing] No user found, creating a new user for this login');
+	const count = await db.incrObjectField('locks', `session-sharing-create:${userData.id}`);
+	if (count > 1) {
+		throw new Error('duplicate-creation');
+	}
+	try {
+		winston.verbose('[session-sharing] No user found, creating a new user for this login');
 
-	const uid = await user.create(_.pick(userData, profileFields));
-	await db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id);
-	return uid;
+		const uid = await user.create(_.pick(userData, profileFields));
+		await db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id);
+		return uid;
+	} finally {
+		await db.deleteObjectFields('locks', [`session-sharing-create:${userData.id}`]);
+	}
 };
 
 plugin.addMiddleware = async function ({ req, res }) {
@@ -439,6 +455,7 @@ plugin.addMiddleware = async function ({ req, res }) {
 			const uid = await plugin.process(req.cookies[plugin.settings.cookieName]);
 			if (uid === req.uid) {
 				winston.verbose(`[session-sharing] Re-validated login for uid ${uid}, path ${req.originalUrl}`);
+				await nbbAuthController.onSuccessfulLogin(req, uid);
 				return;
 			}
 
@@ -460,6 +477,9 @@ plugin.addMiddleware = async function ({ req, res }) {
 					winston.info('[session-sharing] Payload valid, but local account not found.  Assuming guest.');
 					handleAsGuest = true;
 					break;
+				case 'duplicate-creation':
+					winston.warn('[session-sharing] Duplicate account creation attempt detected');
+					break;
 				default:
 					winston.warn('[session-sharing] Error encountered while parsing token: ' + error.message);
 					break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {