T3MP3ST public launch build

2026-07-03 10:57:20 -04:00
1 parent 972247b881
commit 184c7d4e59
@@ -0,0 +1,47 @@
+--- server/api/command/index.js
+@@ -78,7 +78,7 @@ module.exports = {
+             if (res.statusCode === 403) {
+                 runtime.logger.error("api get getTagValue: Tocken Expired");
+             } else if (!authJwt.haveAdminPermission(permission) && !runtime.scriptsMgr.isAuthorisedByScriptName(req.query.sourceScriptName, permission)) {
+-                res.status(400).json({error:"unauthorized_error", message: "Unauthorized!"});
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                 runtime.logger.error("api get getTagValue: Unauthorized");
+             } else {
+                 try {
+
+--- server/integrations/node-red/index.js
+@@ -152,12 +152,11 @@ async function mountNodeRedIfInstalled({ app, server, settings, runtime, logger,
+         });
+     };
+ 
+-    // Allow public dashboard UI and socket.io; require JWT or API key for admin/editor/flows when security is enabled
+    // Allow only dashboard routes as public; require JWT or API key for admin/editor/flows when security is enabled
+     const allowDashboard = (req, res, next) => {
+-        const url = req.originalUrl || req.url || req.path;
+-
+-        // Public dashboard UI and its HTTP APIs (served from httpNodeRoot/ui.path)
+-        if (url.includes('/dashboard') || url.includes('/socket.io')) return next();
+        // Public dashboard UI and its HTTP APIs (served from httpNodeRoot/ui.path).
+        // baseUrl comes from Express mount point and is not affected by query/path tricks.
+        if (req.baseUrl === '/dashboard') return next();
+ 
+         if (!settings.secureEnabled || settings.nodeRedAuthMode === 'legacy-open') {
+             return next();
+
+--- server/runtime/scripts/index.js
+@@ -106,7 +106,7 @@ function ScriptsManager(_runtime) {
+     this.isAuthorisedByScriptName = function (scriptName, permission) {
+         const script = scriptModule.getScriptByName(scriptName);
+         if (!script) {
+-            return true;
+            return false;
+         }
+         return this.isAuthorised(script, permission);
+     }
+@@ -366,4 +366,4 @@ const ScriptSchedulingMode = {
+ const SchedulerType = {
+     weekly: 0,
+     date: 1,
+-}
+\ No newline at end of file
+}