[mirotalksfu] - improve security & minor fix

app/src/Logger.js

@@ -4,6 +4,8 @@ const util = require('util');
 
 const colors = require('colors');
 
+const config = require('./config');
+
 colors.enable(); //colors.disable();
 
 const options = {
@@ -11,9 +13,9 @@ const options = {
     colors: true,
 };
 module.exports = class Logger {
-    constructor(appName = 'miroTalkSfu', debugOn = true) {
+    constructor(appName = 'miroTalkSfu') {
         this.appName = colors.yellow(appName);
-        this.debugOn = debugOn;
+        this.debugOn = config.console.debug;
         this.timeStart = Date.now();
         this.timeEnd = null;
         this.timeElapsedMs = null;

app/src/Server.js

@@ -563,14 +563,17 @@ function startServer() {
             roomList.get(socket.room_id).broadCast(socket.id, 'cmd', data);
         });
 
-        socket.on('roomAction', (dataObject) => {
+        socket.on('roomAction', async (dataObject) => {
             if (!roomList.has(socket.room_id)) return;
 
             const data = checkXSS(dataObject);
 
+            const isPresenter = await isPeerPresenter(socket.room_id, data.peer_name, data.peer_uuid);
+
             log.debug('Room action:', data);
             switch (data.action) {
                 case 'lock':
+                    if (!isPresenter) return;
                     if (!roomList.get(socket.room_id).isLocked()) {
                         roomList.get(socket.room_id).setLocked(true, data.password);
                         roomList.get(socket.room_id).broadCast(socket.id, 'roomAction', data.action);
@@ -588,14 +591,17 @@ function startServer() {
                     roomList.get(socket.room_id).sendTo(socket.id, 'roomPassword', roomData);
                     break;
                 case 'unlock':
+                    if (!isPresenter) return;
                     roomList.get(socket.room_id).setLocked(false);
                     roomList.get(socket.room_id).broadCast(socket.id, 'roomAction', data.action);
                     break;
                 case 'lobbyOn':
+                    if (!isPresenter) return;
                     roomList.get(socket.room_id).setLobbyEnabled(true);
                     roomList.get(socket.room_id).broadCast(socket.id, 'roomAction', data.action);
                     break;
                 case 'lobbyOff':
+                    if (!isPresenter) return;
                     roomList.get(socket.room_id).setLobbyEnabled(false);
                     roomList.get(socket.room_id).broadCast(socket.id, 'roomAction', data.action);
                     break;
@@ -630,13 +636,19 @@ function startServer() {
             }
         });
 
-        socket.on('peerAction', (dataObject) => {
+        socket.on('peerAction', async (dataObject) => {
             if (!roomList.has(socket.room_id)) return;
 
             const data = checkXSS(dataObject);
 
             log.debug('Peer action', data);
 
+            const presenterActions = ['mute', 'hide', 'eject'];
+            if (presenterActions.some((v) => data.action === v)) {
+                const isPresenter = await isPeerPresenter(socket.room_id, data.from_peer_name, data.from_peer_uuid);
+                if (!isPresenter) return;
+            }
+
             if (data.broadcast) {
                 roomList.get(socket.room_id).broadCast(data.peer_id, 'peerAction', data);
             } else {
@@ -1067,11 +1079,23 @@ function startServer() {
     });
 
     async function isPeerPresenter(room_id, peer_name, peer_uuid) {
-        const isPresenter =
-            Object.keys(presenters[room_id]).length > 1 &&
-            presenters[room_id]['peer_name'] === peer_name &&
-            presenters[room_id]['peer_uuid'] === peer_uuid;
-        log.debug(peer_name, { isPresenter: isPresenter });
+        let isPresenter = false;
+        try {
+            isPresenter =
+                typeof presenters === 'object' &&
+                Object.keys(presenters[room_id]).length > 1 &&
+                presenters[room_id]['peer_name'] === peer_name &&
+                presenters[room_id]['peer_uuid'] === peer_uuid;
+        } catch (err) {
+            log.error('isPeerPresenter', err);
+            return false;
+        }
+        log.debug('isPeerPresenter', {
+            room_id: room_id,
+            peer_name: peer_name,
+            peer_uuid: peer_uuid,
+            isPresenter: isPresenter,
+        });
         return isPresenter;
     }
 

app/src/config.template.js

@@ -44,6 +44,9 @@ module.exports = {
         username: 'username',
         password: 'password',
     },
+    console: {
+        debug: true,
+    },
     ngrok: {
         /* 
         Ngrok