Meshcentral: [Bug] User Permissions Do Not Allow Desktop Access

[ryanblenis]

Granting a user permissions (User Authorization on the device) to a single device with "Remote Control" checked as a permission does not grant the user access to view the "Desktop" tab.

Server version 0.6.49

[Ylianst]

So, I just tested this and it worked for me. Giving a single device user permission for just "Remote Control" allows the account to see the Desktop, Terminal and Files tab. Of course, if the agent does not support the Desktop feature, that tab will not show up.

Any more details? Do the other tabs show up?

[ryanblenis]

Odd. The General, Events, Details, and Plugins tabs show up. If I try to go direct to the URL for the desktop (?viewmode=11) there are no options to connect and in the lower right the only options available are the clipboard transfer icons.

[ryanblenis]

Adding the user to have the "Remote Control" permission over the group works as intended and the user is able to see the desktop tab. Once the group permission is removed and only the user permission remains the Desktop tab is removed again.

[Ylianst]

Ok, I found a problem and working on a fix now. Will be in the next version. I should be releasing it in a few hours.

[Ylianst]

If you want to try the fix right now. In file "meshuser.js" around line 605 add the following line:

// Request a list of all nodes
db.GetAllTypeNoTypeFieldMeshFiltered(links, extraids, domain.id, 'node', command.id, function (err, docs) {
   if (docs == null) { docs = []; }
   parent.common.unEscapeAllLinksFieldName(docs);              <-------------------

[ryanblenis]

I'll have to wait until after-hours. People are currently in the middle of sessions- but thank you as always for a quick response!

[Ylianst]

MeshCentral v0.6.54 is published now with this fix and added consent flags in user groups.

[ryanblenis]

Thank you as always @Ylianst ! Fix confirmed!