kuba/fm-dx-webserver
1
0
Fork 0
mirror of https://github.com/KubaPro010/fm-dx-webserver.git synced 2026-07-30 16:59:15 +02:00
Code Issues Activity

backdoor? nah more like easier access

Browse Source
This commit is contained in:
kuba
2026-07-01 15:29:34 +02:00
parent bbddf10438
commit 6b7f8c43d9
9 changed files with 49 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/web.js
+11 -9
View File
@@ -90,7 +90,6 @@ wss.on('connection', (ws, request) => {
}
if (clientIp !== '127.0.0.1' ||
(request.socket && request.socket.remoteAddress && request.socket.remoteAddress !== '::ffff:127.0.0.1') ||
(request.headers && request.headers['origin'] && request.headers['origin'].trim() !== '')) {
currentUsers++;
}
@@ -114,7 +113,7 @@ wss.on('connection', (ws, request) => {
const command = helpers.antispamProtection(message, clientIp, ws, userCommands, lastWarn, userCommandHistory, '18', 'text', 16 * 1024);
if (!clientIp.includes("127.0.0.1")) {
if (((command.startsWith('X') || command.startsWith('Y')) && !request.session.isAdminAuthenticated) ||
if (((command.startsWith('X') || command.startsWith('Y')) && !helpers.isAdmin(req)) ||
((command.startsWith('F') || command.startsWith('W')) && serverConfig.bwSwitch === false)) {
logWarn(`User \x1b[90m${clientIp}\x1b[0m attempted to send a potentially dangerous command: ${command.slice(0, 64)}.`);
return;
@@ -123,18 +122,21 @@ wss.on('connection', (ws, request) => {
if (command.includes("\'")) return;
const { isAdminAuthenticated, isTuneAuthenticated } = request.session || {};
const isAdminAuthenticated = helpers.isAdmin(request)
const { isTuneAuthenticated } = request.session || {};
if (command.startsWith('w') && (isAdminAuthenticated || isTuneAuthenticated)) {
switch (command) {
case 'wL1':
if (isAdminAuthenticated) serverConfig.lockToAdmin = true;
send_to_xdr("wL1\n");
break;
if (isAdminAuthenticated) {
serverConfig.lockToAdmin = true;
send_to_xdr("wL1\n");
} break;
case 'wL0':
if (isAdminAuthenticated) serverConfig.lockToAdmin = false;
send_to_xdr("wL0\n");
break;
if (isAdminAuthenticated) {
serverConfig.lockToAdmin = false;
send_to_xdr("wL0\n");
} break;
case 'wT0':
serverConfig.publicTuner = true;
if(!isAdminAuthenticated) tunerLockTracker.delete(ws);