Files
Sulka HaroandGitHub 914ba78f36 Security improvement batch (#6622)
* Adds a new method for the server to push notifies to the client, which require administration privileges from the user. If there are messages in queue but user is not privileged, she is notified of pending messages

* Fix unit tests

* Increase timeouts on tests

* Add translations

* * Aggregate admin messages
* Send admin message on auth fail
* Sending messages over bus
* XSS filtering of objects sent over the REST API

* Warn users if their instance is world readable

* Fix adminnotifies init()

* Fix couple issues from Codacy
2021-01-07 22:46:55 +02:00

36 lines
952 B
JavaScript

'use strict';
const _ = require('lodash');
const consts = require('../constants');
function configure (ctx) {
const express = require('express')
, api = express.Router();
api.get('/adminnotifies', function(req, res) {
ctx.authorization.resolveWithRequest(req, function resolved (err, result) {
const isAdmin = ctx.authorization.checkMultiple('*:*:admin', result.shiros); //full admin permissions
const response = {
notifies: []
, notifyCount: 0
};
if (ctx.adminnotifies) {
const notifies = _.filter(ctx.adminnotifies.getNotifies(), function isOld (obj) {
return (obj.persistent || (Date.now() - obj.lastRecorded) < 1000 * 60 * 60 * 8);
});
if (isAdmin) { response.notifies = notifies }
response.notifyCount = notifies.length;
}
res.sendJSONStatus(res, consts.HTTP_OK, response);
});
});
return api;
}
module.exports = configure;