external/MeshCentral
1
0
Fork 0
mirror of https://github.com/Ylianst/MeshCentral.git synced 2025-02-12 11:01:52 +00:00
Code Issues Releases Wiki Activity

Fix database escaping problem in device groups.

Browse source
This commit is contained in:
Ylian Saint-Hilaire 2020-12-30 18:52:44 -08:00
parent 93ace89b69
commit 5a4fdd3d8d
1 changed files with 108 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

83
db.js
View file

@ -97,20 +97,16 @@ module.exports.CreateDB = function (parent, func) {
obj.file.remove({ type: 'smbios' }, { multi: true }); obj.file.remove({ type: 'smbios' }, { multi: true });
} }
// Remove all objects that have a "meshid" that no longer points to a valid mesh. // List of valid identifiers
obj.GetAllType('mesh', function (err, docs) { var validIdentifiers = {}
if (err != null) { parent.debug('db', 'ERROR (GetAll mesh): ' + err); }
var meshlist = []; // Load all user groups
if ((err == null) && (docs.length > 0)) { for (var i in docs) { meshlist.push(docs[i]._id); } } obj.GetAllType('ugrp', function (err, docs) {
if ((obj.databaseType == 4) || (obj.databaseType == 5)) { if (err != null) { parent.debug('db', 'ERROR (GetAll user): ' + err); }
// MariaDB if ((err == null) && (docs.length > 0)) {
sqlDbQuery('DELETE FROM MeshCentral.Main WHERE (extra LIKE ("mesh/%") AND (extra NOT IN ?)', [meshlist], func); for (var i in docs) {
} else if (obj.databaseType == 3) { // Add this as a valid user identifier
// MongoDB validIdentifiers[docs[i]._id] = 1;
obj.file.deleteMany({ meshid: { $exists: true, $nin: meshlist } }, { multi: true });
} else {
// NeDB or MongoJS
obj.file.remove({ meshid: { $exists: true, $nin: meshlist } }, { multi: true });
} }
// Fix all of the creating & login to ticks by seconds, not milliseconds. // Fix all of the creating & login to ticks by seconds, not milliseconds.
@ -120,6 +116,9 @@ module.exports.CreateDB = function (parent, func) {
for (var i in docs) { for (var i in docs) {
var fixed = false; var fixed = false;
// Add this as a valid user identifier
validIdentifiers[docs[i]._id] = 1;
// Fix email address capitalization // Fix email address capitalization
if (docs[i].email && (docs[i].email != docs[i].email.toLowerCase())) { if (docs[i].email && (docs[i].email != docs[i].email.toLowerCase())) {
docs[i].email = docs[i].email.toLowerCase(); fixed = true; docs[i].email = docs[i].email.toLowerCase(); fixed = true;
@ -148,13 +147,66 @@ module.exports.CreateDB = function (parent, func) {
// Save the user if needed // Save the user if needed
if (fixed) { obj.Set(docs[i]); } if (fixed) { obj.Set(docs[i]); }
}
// Remove all objects that have a "meshid" that no longer points to a valid mesh.
// Fix any incorrectly escaped user identifiers
obj.GetAllType('mesh', function (err, docs) {
if (err != null) { parent.debug('db', 'ERROR (GetAll mesh): ' + err); }
var meshlist = [];
if ((err == null) && (docs.length > 0)) {
for (var i in docs) {
var meshChange = false;
docs[i] = common.unEscapeLinksFieldName(docs[i]);
meshlist.push(docs[i]._id);
// Make sure all mesh types are number type, if not, fix it.
if (typeof docs[i].mtype == 'string') { docs[i].mtype = parseInt(docs[i].mtype); meshChange = true; }
// Take a look at the links
if (docs[i].links != null) {
for (var j in docs[i].links) {
if (validIdentifiers[j] == null) {
// This identifier is not known, let see if we can fix it.
var xid = j, xid2 = common.unEscapeFieldName(xid);
while ((xid != xid2) && (validIdentifiers[xid2] == null)) { xid = xid2; xid2 = common.unEscapeFieldName(xid2); }
if (validIdentifiers[xid2] == 1) {
//console.log('Fixing id: ' + j + ' to ' + common.escapeFieldName(xid2));
docs[i].links[xid2] = docs[i].links[j];
delete docs[i].links[j];
meshChange = true;
} else {
// TODO: here, we may want to clean up links to users and user groups that do not exist anymore.
//console.log('Unknown id: ' + j);
}
}
}
}
// Save the updated device group if needed
if (meshChange) { obj.Set(docs[i]); }
}
}
if ((obj.databaseType == 4) || (obj.databaseType == 5)) {
// MariaDB
sqlDbQuery('DELETE FROM MeshCentral.Main WHERE (extra LIKE ("mesh/%") AND (extra NOT IN ?)', [meshlist], func);
} else if (obj.databaseType == 3) {
// MongoDB
obj.file.deleteMany({ meshid: { $exists: true, $nin: meshlist } }, { multi: true });
} else {
// NeDB or MongoJS
obj.file.remove({ meshid: { $exists: true, $nin: meshlist } }, { multi: true });
}
// We are done // We are done
validIdentifiers = null;
if (func) { func(); } if (func) { func(); }
} });
} }
}); });
}
}); });
}; };
// Get encryption key // Get encryption key
@ -1331,6 +1383,7 @@ module.exports.CreateDB = function (parent, func) {
// Check that the server is capable of performing a backup // Check that the server is capable of performing a backup
obj.checkBackupCapability = function (func) { obj.checkBackupCapability = function (func) {
if ((parent.config.settings.autobackup == null) || (parent.config.settings.autobackup == false)) { func(); }
if ((obj.databaseType == 2) || (obj.databaseType == 3)) { if ((obj.databaseType == 2) || (obj.databaseType == 3)) {
// Check that we have access to MongoDump // Check that we have access to MongoDump
var backupPath = parent.backuppath; var backupPath = parent.backuppath;