Merge branch 'master' into cloudflared

server/auth.js

@@ -12,6 +12,10 @@ const { loginRateLimiter } = require("./rate-limiter");
  * @returns {Promise<Bean|null>}
  */
 exports.login = async function (username, password) {
+    if (typeof username !== "string" || typeof password !== "string") {
+        return null;
+    }
+
     let user = await R.findOne("user", " username = ? AND active = 1 ", [
         username,
     ]);

server/model/monitor.js

@@ -477,6 +477,12 @@ class Monitor extends BeanModel {
     stop() {
         clearTimeout(this.heartbeatInterval);
         this.isStop = true;
+
+        this.prometheus().remove();
+    }
+
+    prometheus() {
+        return new Prometheus(this);
     }
 
     /**

server/prometheus.js

@@ -86,6 +86,16 @@ class Prometheus {
         }
     }
 
+    remove() {
+        try {
+            monitor_cert_days_remaining.remove(this.monitorLabelValues);
+            monitor_cert_is_valid.remove(this.monitorLabelValues);
+            monitor_response_time.remove(this.monitorLabelValues);
+            monitor_status.remove(this.monitorLabelValues);
+        } catch (e) {
+            console.error(e);
+        }
+    }
 }
 
 module.exports = {

server/rate-limiter.js

@@ -34,6 +34,14 @@ const loginRateLimiter = new KumaRateLimiter({
     errorMessage: "Too frequently, try again later."
 });
 
+const twoFaRateLimiter = new KumaRateLimiter({
+    tokensPerInterval: 30,
+    interval: "minute",
+    fireImmediately: true,
+    errorMessage: "Too frequently, try again later."
+});
+
 module.exports = {
-    loginRateLimiter
+    loginRateLimiter,
+    twoFaRateLimiter,
 };

server/server.js

@@ -52,7 +52,7 @@ console.log("Importing this project modules");
 debug("Importing Monitor");
 const Monitor = require("./model/monitor");
 debug("Importing Settings");
-const { getSettings, setSettings, setting, initJWTSecret, checkLogin, startUnitTest, FBSD, errorLog } = require("./util-server");
+const { getSettings, setSettings, setting, initJWTSecret, checkLogin, startUnitTest, FBSD, errorLog, doubleCheckPassword } = require("./util-server");
 
 debug("Importing Notification");
 const { Notification } = require("./notification");
@@ -63,7 +63,7 @@ const Database = require("./database");
 
 debug("Importing Background Jobs");
 const { initBackgroundJobs } = require("./jobs");
-const { loginRateLimiter } = require("./rate-limiter");
+const { loginRateLimiter, twoFaRateLimiter } = require("./rate-limiter");
 
 const { basicAuth } = require("./auth");
 const { login } = require("./auth");
@@ -306,6 +306,15 @@ exports.entryPage = "dashboard";
         socket.on("login", async (data, callback) => {
             console.log("Login");
 
+            // Checking
+            if (typeof callback !== "function") {
+                return;
+            }
+
+            if (!data) {
+                return;
+            }
+
             // Login Rate Limit
             if (! await loginRateLimiter.pass(callback)) {
                 return;
@@ -364,14 +373,27 @@ exports.entryPage = "dashboard";
         });
 
         socket.on("logout", async (callback) => {
+            // Rate Limit
+            if (! await loginRateLimiter.pass(callback)) {
+                return;
+            }
+
             socket.leave(socket.userID);
             socket.userID = null;
+
+            if (typeof callback === "function") {
                 callback();
+            }
         });
 
-        socket.on("prepare2FA", async (callback) => {
+        socket.on("prepare2FA", async (currentPassword, callback) => {
             try {
+                if (! await twoFaRateLimiter.pass(callback)) {
+                    return;
+                }
+
                 checkLogin(socket);
+                await doubleCheckPassword(socket, currentPassword);
 
                 let user = await R.findOne("user", " id = ? AND active = 1 ", [
                     socket.userID,
@@ -406,14 +428,19 @@ exports.entryPage = "dashboard";
             } catch (error) {
                 callback({
                     ok: false,
-                    msg: "Error while trying to prepare 2FA.",
+                    msg: error.message,
                 });
             }
         });
 
-        socket.on("save2FA", async (callback) => {
+        socket.on("save2FA", async (currentPassword, callback) => {
             try {
+                if (! await twoFaRateLimiter.pass(callback)) {
+                    return;
+                }
+
                 checkLogin(socket);
+                await doubleCheckPassword(socket, currentPassword);
 
                 await R.exec("UPDATE `user` SET twofa_status = 1 WHERE id = ? ", [
                     socket.userID,
@@ -426,14 +453,19 @@ exports.entryPage = "dashboard";
             } catch (error) {
                 callback({
                     ok: false,
-                    msg: "Error while trying to change 2FA.",
+                    msg: error.message,
                 });
             }
         });
 
-        socket.on("disable2FA", async (callback) => {
+        socket.on("disable2FA", async (currentPassword, callback) => {
             try {
+                if (! await twoFaRateLimiter.pass(callback)) {
+                    return;
+                }
+
                 checkLogin(socket);
+                await doubleCheckPassword(socket, currentPassword);
                 await TwoFA.disable2FA(socket.userID);
 
                 callback({
@@ -443,12 +475,16 @@ exports.entryPage = "dashboard";
             } catch (error) {
                 callback({
                     ok: false,
-                    msg: "Error while trying to change 2FA.",
+                    msg: error.message,
                 });
             }
         });
 
-        socket.on("verifyToken", async (token, callback) => {
+        socket.on("verifyToken", async (token, currentPassword, callback) => {
+            try {
+                checkLogin(socket);
+                await doubleCheckPassword(socket, currentPassword);
+
                 let user = await R.findOne("user", " id = ? AND active = 1 ", [
                     socket.userID,
                 ]);
@@ -467,12 +503,19 @@ exports.entryPage = "dashboard";
                         valid: false,
                     });
                 }
+
+            } catch (error) {
+                callback({
+                    ok: false,
+                    msg: error.message,
+                });
+            }
         });
 
         socket.on("twoFAStatus", async (callback) => {
+            try {
                 checkLogin(socket);
 
-            try {
                 let user = await R.findOne("user", " id = ? AND active = 1 ", [
                     socket.userID,
                 ]);
@@ -489,9 +532,10 @@ exports.entryPage = "dashboard";
                     });
                 }
             } catch (error) {
+                console.log(error);
                 callback({
                     ok: false,
-                    msg: "Error while trying to get 2FA status.",
+                    msg: error.message,
                 });
             }
         });
@@ -580,6 +624,9 @@ exports.entryPage = "dashboard";
                     throw new Error("Permission denied.");
                 }
 
+                // Reset Prometheus labels
+                monitorList[monitor.id]?.prometheus()?.remove();
+
                 bean.name = monitor.name;
                 bean.type = monitor.type;
                 bean.url = monitor.url;
@@ -937,21 +984,13 @@ exports.entryPage = "dashboard";
                     throw new Error("Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.");
                 }
 
-                let user = await R.findOne("user", " id = ? AND active = 1 ", [
+                let user = await doubleCheckPassword(socket, password.currentPassword);
-                    socket.userID,
+                await user.resetPassword(password.newPassword);
-                ]);
-
-                if (user && passwordHash.verify(password.currentPassword, user.password)) {
-
-                    user.resetPassword(password.newPassword);
 
                 callback({
                     ok: true,
                     msg: "Password has been updated successfully.",
                 });
-                } else {
-                    throw new Error("Incorrect current password");
-                }
 
             } catch (e) {
                 callback({
@@ -978,10 +1017,14 @@ exports.entryPage = "dashboard";
             }
         });
 
-        socket.on("setSettings", async (data, callback) => {
+        socket.on("setSettings", async (data, currentPassword, callback) => {
             try {
                 checkLogin(socket);
 
+                if (data.disableAuth) {
+                    await doubleCheckPassword(socket, currentPassword);
+                }
+
                 await setSettings("general", data);
                 exports.entryPage = data.entryPage;
 

server/util-server.js

@@ -1,9 +1,8 @@
 const tcpp = require("tcp-ping");
 const Ping = require("./ping-lite");
 const { R } = require("redbean-node");
-const { debug } = require("../src/util");
+const { debug, genSecret } = require("../src/util");
 const passwordHash = require("./password-hash");
-const dayjs = require("dayjs");
 const { Resolver } = require("dns");
 const child_process = require("child_process");
 const iconv = require("iconv-lite");
@@ -32,7 +31,7 @@ exports.initJWTSecret = async () => {
         jwtSecretBean.key = "jwtSecret";
     }
 
-    jwtSecretBean.value = passwordHash.generate(dayjs() + "");
+    jwtSecretBean.value = passwordHash.generate(genSecret());
     await R.store(jwtSecretBean);
     return jwtSecretBean;
 };
@@ -321,6 +320,28 @@ exports.checkLogin = (socket) => {
     }
 };
 
+/**
+ * For logged-in users, double-check the password
+ * @param socket
+ * @param currentPassword
+ * @returns {Promise<Bean>}
+ */
+exports.doubleCheckPassword = async (socket, currentPassword) => {
+    if (typeof currentPassword !== "string") {
+        throw new Error("Wrong data type?");
+    }
+
+    let user = await R.findOne("user", " id = ? AND active = 1 ", [
+        socket.userID,
+    ]);
+
+    if (!user || !passwordHash.verify(currentPassword, user.password)) {
+        throw new Error("Incorrect current password");
+    }
+
+    return user;
+};
+
 exports.startUnitTest = async () => {
     console.log("Starting unit test...");
     const npm = /^win/.test(process.platform) ? "npm.cmd" : "npm";

src/components/MonitorList.vue

@@ -9,7 +9,9 @@
                 <a v-if="searchText != ''" class="search-icon" @click="clearSearchText">
                     <font-awesome-icon icon="times" />
                 </a>
-                <input v-model="searchText" class="form-control search-input" :placeholder="$t('Search...')" />
+                <form>
+                    <input v-model="searchText" class="form-control search-input" :placeholder="$t('Search...')" autocomplete="off" />
+                </form>
             </div>
         </div>
         <div class="monitor-list" :class="{ scrollbar: scrollbar }">

src/components/TwoFADialog.vue

@@ -19,6 +19,19 @@
                             </div>
                             <p v-if="showURI && twoFAStatus == false" class="text-break mt-2">{{ uri }}</p>
 
+                            <div v-if="!(uri && twoFAStatus == false)" class="mb-3">
+                                <label for="current-password" class="form-label">
+                                    {{ $t("Current Password") }}
+                                </label>
+                                <input
+                                    id="current-password"
+                                    v-model="currentPassword"
+                                    type="password"
+                                    class="form-control"
+                                    required
+                                />
+                            </div>
+
                             <button v-if="uri == null && twoFAStatus == false" class="btn btn-primary" type="button" @click="prepare2FA()">
                                 {{ $t("Enable 2FA") }}
                             </button>
@@ -59,11 +72,11 @@
 </template>
 
 <script lang="ts">
-import { Modal } from "bootstrap"
+import { Modal } from "bootstrap";
 import Confirm from "./Confirm.vue";
-import VueQrcode from "vue-qrcode"
+import VueQrcode from "vue-qrcode";
-import { useToast } from "vue-toastification"
+import { useToast } from "vue-toastification";
-const toast = useToast()
+const toast = useToast();
 
 export default {
     components: {
@@ -73,35 +86,36 @@ export default {
     props: {},
     data() {
         return {
+            currentPassword: "",
             processing: false,
             uri: null,
             tokenValid: false,
             twoFAStatus: null,
             token: null,
             showURI: false,
-        }
+        };
     },
     mounted() {
-        this.modal = new Modal(this.$refs.modal)
+        this.modal = new Modal(this.$refs.modal);
         this.getStatus();
     },
     methods: {
         show() {
-            this.modal.show()
+            this.modal.show();
         },
 
         confirmEnableTwoFA() {
-            this.$refs.confirmEnableTwoFA.show()
+            this.$refs.confirmEnableTwoFA.show();
         },
 
         confirmDisableTwoFA() {
-            this.$refs.confirmDisableTwoFA.show()
+            this.$refs.confirmDisableTwoFA.show();
         },
 
         prepare2FA() {
             this.processing = true;
 
-            this.$root.getSocket().emit("prepare2FA", (res) => {
+            this.$root.getSocket().emit("prepare2FA", this.currentPassword, (res) => {
                 this.processing = false;
 
                 if (res.ok) {
@@ -109,49 +123,51 @@ export default {
                 } else {
                     toast.error(res.msg);
                 }
-            })
+            });
         },
 
         save2FA() {
             this.processing = true;
 
-            this.$root.getSocket().emit("save2FA", (res) => {
+            this.$root.getSocket().emit("save2FA", this.currentPassword, (res) => {
                 this.processing = false;
 
                 if (res.ok) {
-                    this.$root.toastRes(res)
+                    this.$root.toastRes(res);
                     this.getStatus();
+                    this.currentPassword = "";
                     this.modal.hide();
                 } else {
                     toast.error(res.msg);
                 }
-            })
+            });
         },
 
         disable2FA() {
             this.processing = true;
 
-            this.$root.getSocket().emit("disable2FA", (res) => {
+            this.$root.getSocket().emit("disable2FA", this.currentPassword, (res) => {
                 this.processing = false;
 
                 if (res.ok) {
-                    this.$root.toastRes(res)
+                    this.$root.toastRes(res);
                     this.getStatus();
+                    this.currentPassword = "";
                     this.modal.hide();
                 } else {
                     toast.error(res.msg);
                 }
-            })
+            });
         },
 
         verifyToken() {
-            this.$root.getSocket().emit("verifyToken", this.token, (res) => {
+            this.$root.getSocket().emit("verifyToken", this.token, this.currentPassword, (res) => {
                 if (res.ok) {
                     this.tokenValid = res.valid;
                 } else {
                     toast.error(res.msg);
                 }
-            })
+            });
         },
 
         getStatus() {
@@ -161,10 +177,10 @@ export default {
                 } else {
                     toast.error(res.msg);
                 }
-            })
+            });
         },
     },
-}
+};
 </script>
 
 <style lang="scss" scoped>

src/components/settings/Security.vue

@@ -234,6 +234,19 @@
                 <p>It is designed for scenarios <strong>where you intend to implement third-party authentication</strong> in front of Uptime Kuma such as Cloudflare Access, Authelia or other authentication mechanisms.</p>
                 <p>Please use this option carefully!</p>
             </template>
+
+            <div class="mb-3">
+                <label for="current-password2" class="form-label">
+                    {{ $t("Current Password") }}
+                </label>
+                <input
+                    id="current-password2"
+                    v-model="password.currentPassword"
+                    type="password"
+                    class="form-control"
+                    required
+                />
+            </div>
         </Confirm>
     </div>
 </template>
@@ -310,7 +323,12 @@ export default {
 
         disableAuth() {
             this.settings.disableAuth = true;
-            this.saveSettings();
+
+            // Need current password to disable auth
+            // Set it to empty if done
+            this.saveSettings(() => {
+                this.password.currentPassword = "";
+            }, this.password.currentPassword);
         },
 
         enableAuth() {

src/languages/ru-RU.js

@@ -180,8 +180,8 @@ export default {
     "Add a monitor": "Добавить монитор",
     "Edit Status Page": "Редактировать",
     "Go to Dashboard": "Панель управления",
-    "Status Page": "Мониторинг",
+    "Status Page": "Страница статуса",
-    "Status Pages": "Página de Status",
+    "Status Pages": "Страницы статуса",
     Discard: "Отмена",
     "Create Incident": "Создать инцидент",
     "Switch to Dark Theme": "Тёмная тема",
@@ -311,28 +311,28 @@ export default {
     "One record": "Одна запись",
     steamApiKeyDescription: "Для мониторинга игрового сервера Steam вам необходим Web-API ключ Steam. Зарегистрировать его можно здесь: ",
     "Certificate Chain": "Цепочка сертификатов",
-    "Valid": "Действительный",
+    Valid: "Действительный",
     "Hide Tags": "Скрыть тэги",
     Title: "Название инцидента:",
     Content: "Содержание инцидента:",
     Post: "Опубликовать",
-    "Cancel": "Отмена",
+    Cancel: "Отмена",
-    "Created": "Создано",
+    Created: "Создано",
-    "Unpin": "Открепить",
+    Unpin: "Открепить",
     "Show Tags": "Показать тэги",
-    "recent": "Сейчас",
+    recent: "Сейчас",
     "3h": "3 часа",
     "6h": "6 часов",
     "24h": "24 часа",
     "1w": "1 неделя",
     "No monitors available.": "Нет доступных мониторов",
     "Add one": "Добавить новый",
-    "Backup": "Резервная копия",
+    Backup: "Резервная копия",
-    "Security": "Безопасность",
+    Security: "Безопасность",
     "Shrink Database": "Сжать Базу Данных",
     "Current User": "Текущий пользователь",
-    "About": "О программе",
+    About: "О программе",
-    "Description": "Описание",
+    Description: "Описание",
     "Powered by": "Работает на основе скрипта от",
     shrinkDatabaseDescription: "Включает VACUUM для базы данных SQLite. Если ваша база данных была создана на версии 1.10.0 и более, AUTO_VACUUM уже включен и это действие не требуется.",
     deleteStatusPageMsg: "Вы действительно хотите удалить эту страницу статуса сервисов?",
@@ -343,4 +343,50 @@ export default {
     primary: "ОСНОВНОЙ",
     light: "СВЕТЛЫЙ",
     dark: "ТЕМНЫЙ",
+    "New Status Page": "Новая страница статуса",
+    "Show update if available": "Показывать доступные обновления",
+    "Also check beta release": "Проверять обновления для бета версий",
+    "Add New Status Page": "Добавить страницу статуса",
+    Next: "Далее",
+    "Accept characters: a-z 0-9 -": "Разрешены символы: a-z 0-9 -",
+    "Start or end with a-z 0-9 only": "Начало и окончание имени только на символы: a-z 0-9",
+    "No consecutive dashes --": "Запрещено использовать тире --",
+    "HTTP Options": "HTTP Опции",
+    "Basic Auth": "HTTP Авторизация",
+    PushByTechulus: "Push by Techulus",
+    clicksendsms: "ClickSend SMS",
+    GoogleChat: "Google Chat (только Google Workspace)",
+    apiCredentials: "API реквизиты",
+    Done: "Готово",
+    Info: "Инфо",
+    "Steam API Key": "Steam API-Ключ",
+    "Pick a RR-Type...": "Выберите RR-Тип...",
+    "Pick Accepted Status Codes...": "Выберите принятые коды состояния...",
+    Default: "По умолчанию",
+    "Please input title and content": "Пожалуйста, введите название и содержание",
+    "Last Updated": "Последнее Обновление",
+    "Untitled Group": "Группа без названия",
+    Services: "Сервисы",
+    serwersms: "SerwerSMS.pl",
+    serwersmsAPIUser: "API Пользователь (включая префикс webapi_)",
+    serwersmsAPIPassword: "API Пароль",
+    serwersmsPhoneNumber: "Номер телефона",
+    serwersmsSenderName: "SMS Имя Отправителя (регистрированный через пользовательский портал)",
+    stackfield: "Stackfield",
+    smtpDkimSettings: "DKIM Настройки",
+    smtpDkimDesc: "Please refer to the Nodemailer DKIM {0} for usage.",
+    documentation: "документация",
+    smtpDkimDomain: "Имя Домена",
+    smtpDkimKeySelector: "Ключ",
+    smtpDkimPrivateKey: "Приватный ключ",
+    smtpDkimHashAlgo: "Алгоритм хэша (опционально)",
+    smtpDkimheaderFieldNames: "Заголовок ключей для подписи (опционально)",
+    smtpDkimskipFields: "Заколовок ключей не для подписи (опционально)",
+    gorush: "Gorush",
+    alerta: "Alerta",
+    alertaApiEndpoint: "Конечная точка API",
+    alertaEnvironment: "Среда",
+    alertaApiKey: "Ключ API",
+    alertaAlertState: "Состояние алерта",
+    alertaRecoverState: "Состояние восстановления",
 };

src/pages/Settings.vue

@@ -131,10 +131,18 @@ export default {
             });
         },
 
-        saveSettings() {
+        /**
-            this.$root.getSocket().emit("setSettings", this.settings, (res) => {
+         * Save Settings
+         * @param currentPassword (Optional) Only need for disableAuth to true
+         */
+        saveSettings(callback, currentPassword) {
+            this.$root.getSocket().emit("setSettings", this.settings, currentPassword, (res) => {
                 this.$root.toastRes(res);
                 this.loadSettings();
+
+                if (callback) {
+                    callback();
+                }
             });
         },
     }