Fixed insecure dependencies.

MeshCentralServer.njsproj

@@ -627,6 +627,7 @@
     <Folder Include="typings\" />
     <Folder Include="typings\globals\" />
     <Folder Include="typings\globals\ajv\" />
+    <Folder Include="typings\globals\async\" />
     <Folder Include="typings\globals\axios\" />
     <Folder Include="typings\globals\connect-redis\" />
     <Folder Include="typings\globals\cookie-session\" />
@@ -640,9 +641,11 @@
     <Folder Include="typings\globals\handlebars\" />
     <Folder Include="typings\globals\he\" />
     <Folder Include="typings\globals\hooker\" />
+    <Folder Include="typings\globals\http-errors\" />
     <Folder Include="typings\globals\is-plain-object\" />
     <Folder Include="typings\globals\jsbn\" />
     <Folder Include="typings\globals\klaw\" />
+    <Folder Include="typings\globals\localforage\" />
     <Folder Include="typings\globals\lru-cache\" />
     <Folder Include="typings\globals\marked\" />
     <Folder Include="typings\globals\moment\" />
@@ -650,14 +653,17 @@
     <Folder Include="typings\globals\nodemailer\" />
     <Folder Include="typings\globals\node\" />
     <Folder Include="typings\globals\object-assign\" />
+    <Folder Include="typings\globals\once\" />
     <Folder Include="typings\globals\passport\" />
     <Folder Include="typings\globals\sprintf-js\" />
     <Folder Include="typings\globals\type-check\" />
+    <Folder Include="typings\globals\underscore\" />
     <Folder Include="typings\globals\uuid\" />
     <Folder Include="views\" />
   </ItemGroup>
   <ItemGroup>
     <TypeScriptCompile Include="typings\globals\ajv\index.d.ts" />
+    <TypeScriptCompile Include="typings\globals\async\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\axios\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\connect-redis\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\cookie-session\index.d.ts" />
@@ -671,9 +677,11 @@
     <TypeScriptCompile Include="typings\globals\handlebars\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\he\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\hooker\index.d.ts" />
+    <TypeScriptCompile Include="typings\globals\http-errors\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\is-plain-object\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\jsbn\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\klaw\index.d.ts" />
+    <TypeScriptCompile Include="typings\globals\localforage\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\lru-cache\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\marked\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\moment\index.d.ts" />
@@ -681,9 +689,11 @@
     <TypeScriptCompile Include="typings\globals\nodemailer\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\node\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\object-assign\index.d.ts" />
+    <TypeScriptCompile Include="typings\globals\once\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\passport\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\sprintf-js\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\type-check\index.d.ts" />
+    <TypeScriptCompile Include="typings\globals\underscore\index.d.ts" />
     <TypeScriptCompile Include="typings\globals\uuid\index.d.ts" />
     <TypeScriptCompile Include="typings\index.d.ts" />
   </ItemGroup>

db.js

@@ -923,7 +923,8 @@ module.exports.CreateDB = function (parent, func) {
     } else {
         // Use NeDB (The default)
         obj.databaseType = 1;
-        Datastore = require('nedb');
+        try { Datastore = require('@yetzt/nedb'); } catch (ex) { } // This is the NeDB with fixed security dependencies.
+        if (Datastore == null) { Datastore = require('nedb'); } // So not to break any existing installations, if the old NeDB is present, use it.
         var datastoreOptions = { filename: parent.getConfigFilePath('meshcentral.db'), autoload: true };
 
         // If a DB encryption key is provided, perform database encryption

dependencies.txt

@@ -6,9 +6,9 @@
     "express-handlebars": "^3.1.0",
     "express-ws": "^4.0.0",
     "ipcheck": "^0.1.0",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.5",
     "multiparty": "^4.2.1",
-    "nedb": "^1.8.0",
+    "@yetzt/nedb": "^1.8.0",
     "node-forge": "^0.10.0",
     "ws": "^5.2.3",
     "yauzl": "^2.10.0"

meshcentral.js

@@ -3298,8 +3298,8 @@ function mainStart() {
         }
 
         // Build the list of required modules
-        var modules = ['ws@5.2.3', 'cbor@5.2.0', 'nedb', 'https', 'yauzl', 'ipcheck', 'express', 'archiver@4.0.2', 'multiparty', 'node-forge', 'express-ws@4.0.0', 'compression', 'body-parser', 'cookie-session', 'express-handlebars'];
+        var modules = ['ws@5.2.3', 'cbor@5.2.0', '@yetzt/nedb', 'https', 'yauzl', 'ipcheck', 'express', 'archiver@4.0.2', 'multiparty', 'node-forge', 'express-ws@4.0.0', 'compression', 'body-parser', 'cookie-session', 'express-handlebars'];
-        if (require('os').platform() == 'win32') { modules.push('node-windows'); modules.push('loadavg-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
+        if (require('os').platform() == 'win32') { modules.push('node-windows@0.1.4'); modules.push('loadavg-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
         if (ldap == true) { modules.push('ldapauth-fork'); }
         if (mstsc == true) { modules.push('node-rdpjs-2'); }
         if (ssh == true) { if (nodeVersion < 11) { addServerWarning('MeshCentral SSH support requires NodeJS 11 or higher.', 1); } else { modules.push('ssh2'); } }

package.json

@@ -44,9 +44,9 @@
     "express-handlebars": "^3.1.0",
     "express-ws": "^4.0.0",
     "ipcheck": "^0.1.0",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.5",
     "multiparty": "^4.2.1",
-    "nedb": "^1.8.0",
+    "@yetzt/nedb": "^1.8.0",
     "node-forge": "^0.10.0",
     "ws": "^5.2.3",
     "yauzl": "^2.10.0"