Merge branch 'staging' of github.com:xwiki-labs/cryptpad into staging

NetfluxWebsocketSrv.js

@@ -232,7 +232,9 @@ const handleMessage = function (ctx, user, msg) {
                 // slice off the sequence number and pass in the rest of the message
                 ctx.rpc(ctx, rpc_call, function (err, output) {
                     if (err) {
-                        console.error('[' + err + ']', output); // TODO make this disableable
+                        if (!ctx.config.suppressRPCErrors) {
+                            console.error('[' + err + ']', output);
+                        }
                         sendMsg(ctx, user, [seq, 'ACK']);
                         sendMsg(ctx, user, [0, HISTORY_KEEPER_ID, 'MSG', user.id, JSON.stringify([parsed[0], 'ERROR', err])]);
                         return

config.js.dist

@@ -137,6 +137,11 @@ module.exports = {
      */
     rpc: './rpc.js',
 
+    /*  RPC errors are shown by default, but if you really don't care,
+     *  you can suppress them
+     */
+    suppressRPCErrors: false,
+
     /* it is recommended that you serve cryptpad over https
      * the filepaths below are used to configure your certificates
      */

rpc.js

@@ -15,11 +15,44 @@ var isValidChannel = function (chan) {
     return /^[a-fA-F0-9]/.test(chan);
 };
 
+var checkSignature = function (signedMsg, publicKey) {
+    if (!(signedMsg && publicKey)) { return null; }
+
+    var signedBuffer = Nacl.util.decodeBase64(signedMsg);
+    var pubBuffer = Nacl.util.decodeBase64(publicKey);
+
+    var opened = Nacl.sign.open(signedBuffer, pubBuffer);
+
+    if (opened) {
+        var decoded = Nacl.util.encodeUTF8(opened);
+        try {
+            return JSON.parse(decoded);
+        } catch (e) { } // fall through to return
+    }
+    return null;
+};
+
 RPC.create = function (config, cb) {
     // load pin-store...
 
     console.log('loading rpc module...');
-    var rpc = function (ctx, msg, respond) {
+    var rpc = function (ctx, args, respond) {
+        if (args.length < 2) {
+            return void respond("INSUFFICIENT_ARGS");
+        }
+
+        var signed = args[0];
+        var publicKey = args[1];
+
+        var msg = checkSignature(signed, publicKey);
+        if (!msg) {
+            return void respond("INVALID_SIGNATURE");
+        }
+
+        if (typeof(msg) !== 'object') {
+            return void respond('INVALID_MSG');
+        }
+
         switch (msg[0]) {
             case 'ECHO':
                 respond(void 0, msg);

www/register/main.js

@@ -108,6 +108,8 @@ define([
 
                 Cryptpad.addLoadingScreen(Messages.login_hashing);
                 Login.loginOrRegister(uname, passwd, true, function (err, result) {
+                    var proxy = result.proxy;
+
                     if (err) {
                         switch (err) {
                             case 'NO_SUCH_USER':
@@ -129,10 +131,10 @@ define([
                                 Cryptpad.removeLoadingScreen(function () {
                                     Cryptpad.confirm(Messages.register_alreadyRegistered, function (yes) {
                                         if (!yes) { return; }
-                                        result.proxy.login_name = uname;
+                                        proxy.login_name = uname;
 
-                                        if (!result.proxy[Cryptpad.displayNameKey]) {
-                                            result.proxy[Cryptpad.displayNameKey] = uname;
+                                        if (!proxy[Cryptpad.displayNameKey]) {
+                                            proxy[Cryptpad.displayNameKey] = uname;
                                         }
                                         Cryptpad.eraseTempSessionValues();
                                         logMeIn(result);
@@ -144,8 +146,6 @@ define([
                         }
                         return;
                     }
-                    var proxy = result.proxy;
-
                     Cryptpad.eraseTempSessionValues();
                     if (shouldImport) {
                         sessionStorage.migrateAnonDrive = 1;
@@ -158,8 +158,8 @@ define([
                     logMeIn(result);
                 });
             }, {
-                ok: Messages.register_writtenPassword, //'I have written down my password, proceed',
-                cancel: Messages.register_cancel, // 'Go back',
+                ok: Messages.register_writtenPassword,
+                cancel: Messages.register_cancel,
                 cancelClass: 'safe',
                 okClass: 'danger',
                 reverseOrder: true,