michael/merlyn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent manager in multi-user from updatingENV via HTTP (#576)

Browse Source 
* prevent manager in multi-user from updatingENV via HTTP

* remove unneeded args
This commit is contained in:
Timothy Carambat 2024-01-11 12:11:45 -08:00 committed by GitHub
parent 3c859ba303
commit 7200a06ef0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server/endpoints/system.js
View File

@ -283,6 +283,12 @@ function systemEndpoints(app) {
[validatedRequest, flexUserRoleValid],
async (request, response) => {
try {
const user = await userFromSession(request, response);
if (!!user && user.role !== "admin") {
response.sendStatus(401).end();
return;
}
const body = reqBody(request);
const { newValues, error } = updateENV(body);
if (process.env.NODE_ENV === "production") await dumpENV();

2
server/utils/http/index.js
View File

@ -20,6 +20,8 @@ function makeJWT(info = {}, expiry = "30d") {
return JWT.sign(info, process.env.JWT_SECRET, { expiresIn: expiry });
}
// Note: Only valid for finding users in multi-user mode
// as single-user mode with password is not a "user"
async function userFromSession(request, response = null) {
if (!!response && !!response.locals?.user) {
return response.locals.user;