BigBlueButton/bigbluebutton-Github
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #10504 from jfsiebel/prevent-ejected-user-validate-auth-token-spam

Browse Source 
Prevent validateAuthToken spamming for ejected users
This commit is contained in:
Anton Georgiev 2020-09-21 16:36:36 -04:00 committed by GitHub
commit 3c6c1f5b7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
bigbluebutton-html5/imports/api/users/server/methods/validateAuthToken.js
View File

@ -3,6 +3,7 @@ import RedisPubSub from '/imports/startup/server/redis';
import Logger from '/imports/startup/server/logger';
import pendingAuthenticationsStore from '../store/pendingAuthentications';
import BannedUsers from '../store/bannedUsers';
import Users from '/imports/api/users';
export default function validateAuthToken(meetingId, requesterUserId, requesterToken, externalId) {
const REDIS_CONFIG = Meteor.settings.private.redis;
@ -13,10 +14,18 @@ export default function validateAuthToken(meetingId, requesterUserId, requesterT
if (externalId) {
if (BannedUsers.has(meetingId, externalId)) {
Logger.warn(`A banned user with extId ${externalId} tried to enter in meeting ${meetingId}`);
return;
return { invalid: true, reason: 'User has been banned.' };
}
}
// Check if a removed user is trying to access the meeting using the same sessionToken
const isUserEjected = Users.findOne({ meetingId, authToken: requesterToken, ejected: true });
if (isUserEjected) {
Logger.warn(`An invalid sessionToken tried to validateAuthToken meetingId=${meetingId} authToken=${requesterToken}`);
return { invalid: true, reason: 'User has been ejected.' };
}
// Store reference of methodInvocationObject ( to postpone the connection userId definition )
pendingAuthenticationsStore.add(meetingId, requesterUserId, requesterToken, this);

4
bigbluebutton-html5/imports/ui/services/auth/index.js
View File

@ -220,11 +220,11 @@ class Auth {
const result = await makeCall('validateAuthToken', this.meetingID, this.userID, this.token, this.externUserID);
if (!result) {
if (result && result.invalid) {
clearTimeout(validationTimeout);
reject({
error: 401,
description: 'User has been banned.',
description: result.reason,
});
return;
}