From 9ed135e08c2f71923890d84f656b01084fc17203 Mon Sep 17 00:00:00 2001
From: Ylian Saint-Hilaire <ysainthilaire@hotmail.com>
Date: Thu, 4 Feb 2021 13:44:40 -0800
Subject: [PATCH] Fixed permissions on uploading custom mesh core.

---
 webserver.js | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/webserver.js b/webserver.js
index 334278ba..a0ed35d0 100644
--- a/webserver.js
+++ b/webserver.js
@@ -3317,22 +3317,27 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
                 if ((loginCookie != null) && (domain.id == loginCookie.domainid)) { authUserid = loginCookie.userid; } // Use cookie authentication
             }
             if (authUserid == null) { res.sendStatus(401); return; }
+            if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
 
             // Get the user
             const user = obj.users[authUserid];
-            if (user.siteadmin != 0xFFFFFFFF) { res.sendStatus(401); return; } // Check if we have mesh core upload rights (Full admin only)
+            if (user == null) { res.sendStatus(401); return; } // Check this user exists
 
-            if ((fields == null) || (fields.attrib == null) || (fields.attrib.length != 1)) { res.sendStatus(404); return; }
-            for (var i in files.files) {
-                var file = files.files[i];
-                obj.fs.readFile(file.path, 'utf8', function (err, data) {
-                    if (err != null) return;
-                    data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
-                    obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
-                    try { obj.fs.unlinkSync(file.path); } catch (e) { }
-                });
-            }
-            res.send('');
+            // Get the node and check node rights
+            const nodeid = fields.attrib[0];
+            obj.GetNodeWithRights(domain, user, nodeid, function (node, rights, visible) {
+                if ((node == null) || (rights != 0xFFFFFFFF) || (visible == false)) { res.sendStatus(404); return; } // We don't have remote control rights to this device
+                for (var i in files.files) {
+                    var file = files.files[i];
+                    obj.fs.readFile(file.path, 'utf8', function (err, data) {
+                        if (err != null) return;
+                        data = obj.common.IntToStr(0) + data; // Add the 4 bytes encoding type & flags (Set to 0 for raw)
+                        obj.sendMeshAgentCore(user, domain, fields.attrib[0], 'custom', data); // Upload the core
+                        try { obj.fs.unlinkSync(file.path); } catch (e) { }
+                    });
+                }
+                res.send('');
+            });
         });
     }