From efdac472b494215f02efb1772578bd012eb75c8d Mon Sep 17 00:00:00 2001 From: ItsOnlyBinary Date: Tue, 2 Mar 2021 18:59:35 +0000 Subject: [PATCH 1/4] Store usernames in lowercase --- src/actions/adduser.js | 4 ++-- src/worker/users.js | 20 ++++++++++++-------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/src/actions/adduser.js b/src/actions/adduser.js index b33ee92..8a1d6cf 100644 --- a/src/actions/adduser.js +++ b/src/actions/adduser.js @@ -30,8 +30,8 @@ module.exports = async function(env, options) { } try { - await app.userDb.addUser(username, password, userIsAdmin); - console.log(`Added new user ${username}`); + const user = await app.userDb.addUser(username, password, userIsAdmin); + console.log(`Added new user ${user.username}`); } catch (err) { l.error('Error adding new user:', err.message); console.log('There was an error adding the new user'); diff --git a/src/worker/users.js b/src/worker/users.js index f53caf1..e16df2f 100644 --- a/src/worker/users.js +++ b/src/worker/users.js @@ -9,9 +9,10 @@ class Users { } async authUserNetwork(username, password, network) { + const lcUsername = username.toLowerCase(); let ret = { network: null, user: null }; - if (!Helpers.validUsername(username)) { + if (!Helpers.validUsername(lcUsername)) { return ret; } @@ -19,7 +20,7 @@ class Users { let isUserToken = false; let query = this.db.dbUsers('user_networks') .innerJoin('users', 'users.id', 'user_networks.user_id') - .where('users.username', 'LIKE', username) + .where('users.username', 'LIKE', lcUsername) .where('user_networks.name', 'LIKE', network) .select('user_networks.*', 'users.password as _pass', 'users.admin as user_admin'); @@ -58,14 +59,15 @@ class Users { } async authUser(username, password, userHost) { - if (!Helpers.validUsername(username)) { + const lcUsername = username.toLowerCase(); + if (!Helpers.validUsername(lcUsername)) { return null; } let isUserToken = false; let query = this.db.dbUsers('users') .select('users.*') - .where('username', 'LIKE', username) + .where('username', 'LIKE', lcUsername) .where('locked', '!=', true); if (tokens.isUserToken(password)) { @@ -172,20 +174,22 @@ class Users { } async getUser(username) { - if (!Helpers.validUsername(username)) { + const lcUsername = username.toLowerCase(); + if (!Helpers.validUsername(lcUsername)) { return null; } - return this.db.factories.User.query().where('username', 'LIKE', username).first(); + return this.db.factories.User.query().where('username', 'LIKE', lcUsername).first(); } async addUser(username, password, isAdmin) { - if (!Helpers.validUsername(username)) { + const lcUsername = username.toLowerCase(); + if (!Helpers.validUsername(lcUsername)) { throw new Error('Invalid username'); } let user = this.db.factories.User(); - user.username = username; + user.username = lcUsername; user.password = password; user.created_at = Helpers.now(); if (isAdmin === true) { From df20119131bb644e2930ae795e1e22d2b70f32e8 Mon Sep 17 00:00:00 2001 From: ItsOnlyBinary Date: Thu, 4 Mar 2021 20:18:42 +0000 Subject: [PATCH 2/4] dataIntegrityCheck && exit code handler --- src/actions/run.js | 10 +++++++++- src/libs/dataModels/user.js | 2 +- src/worker/worker.js | 15 +++++++++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/src/actions/run.js b/src/actions/run.js index ca220c8..ed0527b 100644 --- a/src/actions/run.js +++ b/src/actions/run.js @@ -23,7 +23,15 @@ module.exports = async function(env, options) { execArgv: [...process.execArgv], }); socketsApp.queue.emit('_workerProcess', {workerProc}); - workerProc.on('exit', spawnWorker); + + let handleExit = (exitCode) => { + if (!exitCode || exitCode <= 1) { + spawnWorker(); + } else { + process.exit(exitCode); + } + }; + workerProc.on('exit', handleExit); }; if (process.args.interactive) { diff --git a/src/libs/dataModels/user.js b/src/libs/dataModels/user.js index d0f34b1..5261afe 100644 --- a/src/libs/dataModels/user.js +++ b/src/libs/dataModels/user.js @@ -14,7 +14,7 @@ class User extends DatabaseSavable { get id() { return this.getData('id'); } get username() { return this.getData('username'); } - set username(newVal) { return this.setData('username', newVal); } + set username(newVal) { return this.setData('username', newVal.toLowerCase()); } get password() { return this.getData('password'); } set password(newVal) { diff --git a/src/worker/worker.js b/src/worker/worker.js index 22509aa..323839d 100644 --- a/src/worker/worker.js +++ b/src/worker/worker.js @@ -46,6 +46,7 @@ async function run() { }); } + await dataIntegrityCheck(app); initWebserver(app); initStatus(app); @@ -60,6 +61,20 @@ async function run() { return app; } +async function dataIntegrityCheck(app) { + if (app.conf.get('database.skip_data_integrity_check', false)) { + return; + } + const count = await app.db.dbUsers('users').count('* as count') + .whereRaw('LOWER(`username`) != `username`') + .first().then(r => r.count); + + if (count > 0) { + l.error('Case sensitive usernames detected in database') + process.exit(15); + } +} + async function initExtensions(app) { let extensions = app.conf.get('extensions.loaded') || []; for(let i=0; i Date: Fri, 5 Mar 2021 18:34:11 +0000 Subject: [PATCH 3/4] Improve error with link to wiki --- src/worker/worker.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/worker/worker.js b/src/worker/worker.js index 323839d..522759b 100644 --- a/src/worker/worker.js +++ b/src/worker/worker.js @@ -70,7 +70,8 @@ async function dataIntegrityCheck(app) { .first().then(r => r.count); if (count > 0) { - l.error('Case sensitive usernames detected in database') + l.error('Case sensitive usernames detected in database... Shutting down!'); + l.error('for more information see: https://github.com/kiwiirc/kiwibnc/wiki/Fixing-Case-Sensitive-Usernames'); process.exit(15); } } From cbb803edcef4f36f2226be093d0b35c682182e39 Mon Sep 17 00:00:00 2001 From: ItsOnlyBinary Date: Sun, 7 Mar 2021 21:08:22 +0000 Subject: [PATCH 4/4] remove backticks from raw query --- src/worker/worker.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/worker/worker.js b/src/worker/worker.js index 522759b..db7090e 100644 --- a/src/worker/worker.js +++ b/src/worker/worker.js @@ -66,7 +66,7 @@ async function dataIntegrityCheck(app) { return; } const count = await app.db.dbUsers('users').count('* as count') - .whereRaw('LOWER(`username`) != `username`') + .whereRaw('LOWER(username) != username') .first().then(r => r.count); if (count > 0) {