diff --git a/bigbluebutton-html5/imports/api/users/server/methods.js b/bigbluebutton-html5/imports/api/users/server/methods.js index 98aa67982f..7630793f14 100644 --- a/bigbluebutton-html5/imports/api/users/server/methods.js +++ b/bigbluebutton-html5/imports/api/users/server/methods.js @@ -8,6 +8,7 @@ import toggleUserLock from './methods/toggleUserLock'; import setUserEffectiveConnectionType from './methods/setUserEffectiveConnectionType'; import userActivitySign from './methods/userActivitySign'; import userLeftMeeting from './methods/userLeftMeeting'; +import checkSessionToken from './methods/checkSessionToken'; Meteor.methods({ setEmojiStatus, @@ -19,4 +20,5 @@ Meteor.methods({ setUserEffectiveConnectionType, userActivitySign, userLeftMeeting, + checkSessionToken, }); diff --git a/bigbluebutton-html5/imports/api/users/server/methods/checkSessionToken.js b/bigbluebutton-html5/imports/api/users/server/methods/checkSessionToken.js new file mode 100644 index 0000000000..9d6c0a139b --- /dev/null +++ b/bigbluebutton-html5/imports/api/users/server/methods/checkSessionToken.js @@ -0,0 +1,28 @@ +import Users from '/imports/api/users'; +import Logger from '/imports/startup/server/logger'; +import BannedUsers from '../store/bannedUsers'; + +export default function checkSessionToken(meetingId, requesterUserId, requesterToken, externalId) { + // Check if externalId is banned from the meeting + if (externalId) { + if (BannedUsers.has(meetingId, externalId)) { + Logger.warn(`A banned user with extId ${externalId} tried to enter in meeting ${meetingId}`); + return { invalid: true, reason: 'User has been banned' }; + } + } + + // Prevent users who have left or been ejected to use the same sessionToken again. + const isUserInvalid = Users.findOne({ + meetingId, + userId: requesterUserId, + authToken: requesterToken, + $or: [{ ejected: true }, { loggedOut: true }], + }); + + if (isUserInvalid) { + Logger.warn(`An invalid sessionToken tried to validateAuthToken meetingId=${meetingId} authToken=${requesterToken}`); + return { invalid: true, reason: 'User has an invalid sessionToken' }; + } + + return { invalid: false }; +} diff --git a/bigbluebutton-html5/imports/api/users/server/methods/validateAuthToken.js b/bigbluebutton-html5/imports/api/users/server/methods/validateAuthToken.js index cc1014c218..0f01fb0c2d 100644 --- a/bigbluebutton-html5/imports/api/users/server/methods/validateAuthToken.js +++ b/bigbluebutton-html5/imports/api/users/server/methods/validateAuthToken.js @@ -2,30 +2,12 @@ import { Meteor } from 'meteor/meteor'; import RedisPubSub from '/imports/startup/server/redis'; import Logger from '/imports/startup/server/logger'; import pendingAuthenticationsStore from '../store/pendingAuthentications'; -import BannedUsers from '../store/bannedUsers'; -import Users from '/imports/api/users'; -export default function validateAuthToken(meetingId, requesterUserId, requesterToken, externalId) { +export default function validateAuthToken(meetingId, requesterUserId, requesterToken) { const REDIS_CONFIG = Meteor.settings.private.redis; const CHANNEL = REDIS_CONFIG.channels.toAkkaApps; const EVENT_NAME = 'ValidateAuthTokenReqMsg'; - // Check if externalId is banned from the meeting - if (externalId) { - if (BannedUsers.has(meetingId, externalId)) { - Logger.warn(`A banned user with extId ${externalId} tried to enter in meeting ${meetingId}`); - return { invalid: true, reason: 'User has been banned.' }; - } - } - - // Check if a removed user is trying to access the meeting using the same sessionToken - const isUserEjected = Users.findOne({ meetingId, authToken: requesterToken, ejected: true }); - - if (isUserEjected) { - Logger.warn(`An invalid sessionToken tried to validateAuthToken meetingId=${meetingId} authToken=${requesterToken}`); - return { invalid: true, reason: 'User has been ejected.' }; - } - // Store reference of methodInvocationObject ( to postpone the connection userId definition ) pendingAuthenticationsStore.add(meetingId, requesterUserId, requesterToken, this); diff --git a/bigbluebutton-html5/imports/ui/services/auth/index.js b/bigbluebutton-html5/imports/ui/services/auth/index.js index 02368a6e98..e571a07654 100755 --- a/bigbluebutton-html5/imports/ui/services/auth/index.js +++ b/bigbluebutton-html5/imports/ui/services/auth/index.js @@ -218,7 +218,7 @@ class Auth { }); }, CONNECTION_TIMEOUT); - const result = await makeCall('validateAuthToken', this.meetingID, this.userID, this.token, this.externUserID); + const result = await makeCall('checkSessionToken', this.meetingID, this.userID, this.token, this.externUserID); if (result && result.invalid) { clearTimeout(validationTimeout);