Merge pull request #2711 from nzalev/add-version-validation

Added version validation to serverupdate

meshcentral.js

@@ -540,6 +540,24 @@ function CreateMeshCentralServer(config, args) {
         } catch (ex) { callback({ current: getCurrentVersion() }, ex); } // If the system is running out of memory, an exception here can easily happen.
     };
 
+    // Use NPM to get list of versions
+    obj.getServerVersions = function (callback) {
+        try {
+            var child_process = require('child_process');
+            var npmpath = ((typeof obj.args.npmpath == 'string') ? obj.args.npmpath : 'npm');
+            var npmproxy = ((typeof obj.args.npmproxy == 'string') ? (' --proxy ' + obj.args.npmproxy) : '');
+            var env = Object.assign({}, process.env); // Shallow clone
+            if (typeof obj.args.npmproxy == 'string') { env['HTTP_PROXY'] = env['HTTPS_PROXY'] = env['http_proxy'] = env['https_proxy'] = obj.args.npmproxy; }
+            var xxprocess = child_process.exec(npmpath + npmproxy + ' view meshcentral versions --json', { maxBuffer: 512000, cwd: obj.parentpath, env: env }, function (error, stdout, stderr) { });
+            xxprocess.data = '';
+            xxprocess.stdout.on('data', function (data) { xxprocess.data += data; });
+            xxprocess.stderr.on('data', function (data) { });
+            xxprocess.on('close', function (code) {
+                (code == 0) ? callback(xxprocess.data) : callback('{}');
+            });
+        } catch (ex) { callback('{}'); }
+    };
+
     // Initiate server self-update
     obj.performServerUpdate = function (version) {
         if (obj.serverSelfWriteAllowed != true) return false;

meshuser.js

@@ -924,6 +924,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
                                     case 'usersessions': { r = "usersessions: Returns a list of active sessions grouped by user."; break; }
                                     case 'closeusersessions': { r = "closeusersessions: Disconnects all sessions for a specified user."; break; }
                                     case 'tasklimiter': { r = "tasklimiter: Returns the internal status of the tasklimiter. This is a system used to smooth out work done by the server. It's used by, for example, agent updates so that not all agents are updated at the same time."; break; }
+                                    case 'serverupdate': { r = "serverupdate: Updates server to latest version. Optional version argument to install specific version. Example: serverupdate 0.8.49"; break; }
                                     default: { r = 'No help information about this command.'; break; }
                                 }
                             }
@@ -1192,11 +1193,37 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
 
                             if (cmdargs['_'].length > 0) {
                                 version = cmdargs['_'][0];
-                            }
 
+                                // This call is SLOW. We only want to validate version if we have to
+                                if (version != 'stable' && version != 'latest') {
+                                    parent.parent.getServerVersions((data) => {
+                                        var versions = JSON.parse(data);
+
+                                        if (versions.includes(version)) {
+                                            if (parent.parent.performServerUpdate(version) == false) { 
+                                                try { 
+                                                    ws.send(JSON.stringify({ action: 'serverconsole',
+                                                                             value: 'Server self-update not possible.'}));
+                                                } catch (ex) { }
+                                            }
+                                        } else {
+                                            try { 
+                                                ws.send(JSON.stringify({ action: 'serverconsole',
+                                                                         value: 'Invalid version. Aborting update'}));
+                                            } catch (ex) { }
+                                        }
+                                    });
+                                } else {
                                     if (parent.parent.performServerUpdate(version) == false) { 
                                         r = 'Server self-update not possible.';
                                     }
+                                }  
+                            } else {
+                                if (parent.parent.performServerUpdate(version) == false) { 
+                                    r = 'Server self-update not possible.';
+                                }
+                            }
+
                             break;
                         }
                         case 'print': {