47 lines
2.2 KiB
Diff
47 lines
2.2 KiB
Diff
--- server/api/command/index.js
|
|
@@ -78,7 +78,7 @@ module.exports = {
|
|
if (res.statusCode === 403) {
|
|
runtime.logger.error("api get getTagValue: Tocken Expired");
|
|
} else if (!authJwt.haveAdminPermission(permission) && !runtime.scriptsMgr.isAuthorisedByScriptName(req.query.sourceScriptName, permission)) {
|
|
- res.status(400).json({error:"unauthorized_error", message: "Unauthorized!"});
|
|
+ res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
|
|
runtime.logger.error("api get getTagValue: Unauthorized");
|
|
} else {
|
|
try {
|
|
|
|
--- server/integrations/node-red/index.js
|
|
@@ -152,12 +152,11 @@ async function mountNodeRedIfInstalled({ app, server, settings, runtime, logger,
|
|
});
|
|
};
|
|
|
|
- // Allow public dashboard UI and socket.io; require JWT or API key for admin/editor/flows when security is enabled
|
|
+ // Allow only dashboard routes as public; require JWT or API key for admin/editor/flows when security is enabled
|
|
const allowDashboard = (req, res, next) => {
|
|
- const url = req.originalUrl || req.url || req.path;
|
|
-
|
|
- // Public dashboard UI and its HTTP APIs (served from httpNodeRoot/ui.path)
|
|
- if (url.includes('/dashboard') || url.includes('/socket.io')) return next();
|
|
+ // Public dashboard UI and its HTTP APIs (served from httpNodeRoot/ui.path).
|
|
+ // baseUrl comes from Express mount point and is not affected by query/path tricks.
|
|
+ if (req.baseUrl === '/dashboard') return next();
|
|
|
|
if (!settings.secureEnabled || settings.nodeRedAuthMode === 'legacy-open') {
|
|
return next();
|
|
|
|
--- server/runtime/scripts/index.js
|
|
@@ -106,7 +106,7 @@ function ScriptsManager(_runtime) {
|
|
this.isAuthorisedByScriptName = function (scriptName, permission) {
|
|
const script = scriptModule.getScriptByName(scriptName);
|
|
if (!script) {
|
|
- return true;
|
|
+ return false;
|
|
}
|
|
return this.isAuthorised(script, permission);
|
|
}
|
|
@@ -366,4 +366,4 @@ const ScriptSchedulingMode = {
|
|
const SchedulerType = {
|
|
weekly: 0,
|
|
date: 1,
|
|
-}
|
|
\ No newline at end of file
|
|
+}
|