external/MeshCentral
1
0
Fork 0
mirror of https://github.com/Ylianst/MeshCentral.git synced 2025-03-09 15:40:18 +00:00
Code Issues Releases Wiki Activity

Fixed device access control when using ManageAllDeviceGroups.

Browse source
This commit is contained in:
Ylian Saint-Hilaire 2020-05-06 11:47:23 -07:00
parent feb32745ed
commit cae876fd43
2 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
webserver.js
View file

@ -4541,6 +4541,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
db.Get(nodeid, function (err, nodes) {
if ((nodes == null) || (nodes.length != 1)) { func(null, 0, false); return; } // No such nodeid
// This is a super user that can see all device groups for a given domain
if ((user.siteadmin == 0xFFFFFFFF) && (parent.config.settings.managealldevicegroups.indexOf(user._id) >= 0) && (nodes[0].domain == user.domain)) {
func(nodes[0], 0xFFFFFFFF, true); return;
}
// Check device link
var rights = 0, visible = false, r = user.links[nodeid];
if (r != null) {