ARCG/ARCG-Remote-Station-Software
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

require valid OpenWebRX ticket for all authorize calls

Browse Source
This commit is contained in:
oe6dxd-automation
2026-04-02 23:00:45 +02:00
parent 8c031a939c
commit 25bd51c0db
2 changed files with 3 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
server/index.js
View File

@@ -5527,13 +5527,6 @@ function resolveOpenWebRxOwnerFromRequestContext(req, url) {
} }
async function handleOpenWebRxAuthorize(req, res, url) { async function handleOpenWebRxAuthorize(req, res, url) {
if (canAuthorizeOpenWebRxByActiveSession()) {
await ensureOpenWebRxSdrPath(null, { force: false, minIntervalMs: 3000 });
res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
res.end("ok");
return;
}
const queryTicket = String(url.searchParams.get("ticket") || "").trim(); const queryTicket = String(url.searchParams.get("ticket") || "").trim();
const cookieTicket = readCookie(req.headers && req.headers.cookie, "rms_owrx_ticket"); const cookieTicket = readCookie(req.headers && req.headers.cookie, "rms_owrx_ticket");
const originalUriHeader = req.headers ? (req.headers["x-original-uri"] || req.headers["x-rewrite-uri"] || "") : ""; const originalUriHeader = req.headers ? (req.headers["x-original-uri"] || req.headers["x-rewrite-uri"] || "") : "";
@@ -5554,12 +5547,6 @@ async function handleOpenWebRxAuthorize(req, res, url) {
tickets.push(refererTicket); tickets.push(refererTicket);
} }
if (tickets.length === 0) { if (tickets.length === 0) {
if (canAuthorizeOpenWebRxWebSocketWithoutTicket(req, originalUriHeader)) {
await ensureOpenWebRxSdrPath(null, { force: false, minIntervalMs: 3000 });
res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
res.end("ok");
return;
}
res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" }); res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
res.end("forbidden"); res.end("forbidden");
return; return;
@@ -5654,27 +5641,6 @@ function extractTicketFromUri(rawUri) {
return String(params.get("ticket") || "").trim(); return String(params.get("ticket") || "").trim();
} }
function canAuthorizeOpenWebRxWebSocketWithoutTicket(req, originalUriHeader) {
const headers = req && req.headers ? req.headers : {};
const upgrade = String(headers.upgrade || "").toLowerCase();
const hasWebSocketKey = Boolean(headers["sec-websocket-key"]);
const isWebSocket = upgrade === "websocket" || hasWebSocketKey;
if (!isWebSocket) {
return false;
}
if (!runtime.station || !runtime.station.isInUse || !runtime.station.activeByUserId) {
return false;
}
return true;
}
function canAuthorizeOpenWebRxByActiveSession() {
if (!runtime.station || !runtime.station.isInUse || !runtime.station.activeByUserId) {
return false;
}
return true;
}
async function handleHelpContent(res, user) { async function handleHelpContent(res, user) {
if (!hasRole(user, ["operator", "approver", "admin"])) { if (!hasRole(user, ["operator", "approver", "admin"])) {
return sendError(res, 403, "auth.forbidden", "Nicht berechtigt"); return sendError(res, 403, "auth.forbidden", "Nicht berechtigt");

3
test/auth-methods.integration.test.js
View File

@@ -1671,6 +1671,9 @@ test("openwebrx session is owner-bound and release disables tx first", async (t)
const authOk = await fetch(`${baseUrl}/v1/openwebrx/authorize?ticket=${encodeURIComponent(session.session.ticket)}`); const authOk = await fetch(`${baseUrl}/v1/openwebrx/authorize?ticket=${encodeURIComponent(session.session.ticket)}`);
assert.equal(authOk.status, 200); assert.equal(authOk.status, 200);
const authWithoutTicket = await fetch(`${baseUrl}/v1/openwebrx/authorize`);
assert.equal(authWithoutTicket.status, 403);
await requestJson(baseUrl, "/v1/openwebrx/tx/enable", { await requestJson(baseUrl, "/v1/openwebrx/tx/enable", {
method: "POST", method: "POST",
headers, headers,